joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061800
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r9d, ecx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x1401146d0]
movsxd rcx, dword [rax + 0x4ae8]
cmp dword [rax + 0x4ad8], ecx
jle 0x1400616d2
mov esi, edx
mov rdx, qword [rax + 0x4ae0]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], r9d
jne 0x1400616d2
test esi, 0x10000000
jne 0x1400616f4
lea r8, str.Popup__08x
jmp 0x140061702
mov dword [rax + 0x4a00], 0
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a1e40
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x5e24]
lea r8, str.Menu__02d
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.1400445d0
or esi, 0x4000000
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.1400553b0
mov esi, eax
test al, al
jne 0x1400616de
mov rdi, qword [0x1401146d0]
mov rax, qword [rdi + 0x4000]
cmp qword [rdi + 0x4b18], rax
je 0x14006175e
test byte [rax + 0x17], 1
je 0x140061750
mov byte [rdi + 0x3f66], 1
call fcn.14005aa50
mov byte [rdi + 0x3f66], 0
jmp 0x1400616de
cmp byte [rdi + 0x4bc1], 0
je 0x140061743
cmp dword [rdi + 0x4b68], 0
jne 0x140061743
mov ecx, dword [rdi + 0x4bc4]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rdi + 0x4bc4], ecx
jmp 0x140061743
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rcx
mov rax, qword [0x1401146d0]
mov ecx, dword [rax + 0x4ad8]
cmp ecx, dword [rax + 0x4ae8]
jle 0x140061895
mov esi, edx
mov rax, qword [rax + 0x4000]
mov rcx, qword [rax + 0x108]
movsxd rdx, dword [rax + 0x100]
mov edi, dword [rcx + rdx*4 - 4]
movzx ecx, byte [r8]
test cl, cl
je 0x1400618af
not edi
lea rdx, [r8 + 2]
lea r9, [0x1400a5760]
mov r10d, edi
jmp 0x14006187a
movzx r11d, r11b
movzx ebx, r10b
shr r10d, 8
xor ebx, r11d
xor r10d, dword [r9 + rbx*4]
inc rdx
test cl, cl
je 0x1400618a9
mov r11d, ecx
movzx ecx, byte [rdx - 1]
cmp r11b, 0x23
jne 0x140061860
cmp cl, 0x23
jne 0x140061860
cmp byte [rdx], 0x23
cmove r10d, edi
jmp 0x140061860
mov dword [rax + 0x4a00], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
not r10d
mov edi, r10d
or esi, 0x141
mov rax, qword [rax]
cmp dword [rax + 0x404c], edi
jne 0x1400618cf
mov ecx, edi
mov edx, 0xb
xor r9d, r9d
call fcn.14004cea0
mov ecx, edi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140061680
Function at 0x1400618e0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x1401146d0]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x387e], 0
je 0x1400619a4
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x4000]
cmp eax, 0xa
ja 0x14006192b
add eax, 0x8f
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x40e4], 0
jne 0x1400619a4
mov ecx, 0x20
call fcn.14004dbd0
test al, al
je 0x1400619a4
test rdi, rdi
je 0x1400619d3
mov rax, qword [r14 + 0x108]
movsxd rcx, dword [r14 + 0x100]
mov ebx, dword [rax + rcx*4 - 4]
movzx eax, byte [rdi]
test al, al
je 0x1400619b4
not ebx
lea rcx, [rdi + 2]
lea rdx, [0x1400a5760]
mov r8d, ebx
jmp 0x14006198a
movzx r9d, r9b
movzx r10d, r8b
shr r8d, 8
xor r10d, r9d
xor r8d, dword [rdx + r10*4]
inc rcx
test al, al
je 0x1400619ae
mov r9d, eax
movzx eax, byte [rcx - 1]
cmp r9b, 0x23
jne 0x140061970
cmp al, 0x23
jne 0x140061970
cmp byte [rcx], 0x23
cmove r8d, ebx
jmp 0x140061970
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not r8d
mov ebx, r8d
mov rax, qword [r14]
cmp dword [rax + 0x404c], ebx
jne 0x1400619d9
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.14004cea0
jmp 0x1400619d9
mov ebx, dword [rbx + 0x49b0]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140061190
Function at 0x1400634e0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, qword [0x1401146d0]
cmp byte [r14 + 0x6008], 0
je 0x140063598
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
lea rbx, [r14 + 0x6018]
cmp qword [r14 + 0x6010], 0
je 0x14006358a
xor ebp, ebp
mov rcx, rbx
xor edx, edx
call fcn.140045750
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140045950
mov r9, qword [r14 + 0x6010]
mov eax, dword [r14 + 0x6018]
sub eax, 1
cmovb eax, ebp
movsxd r8, eax
mov rax, qword [r14 + 0x6020]
test rax, rax
lea rcx, [0x1401146d8]
cmovne rcx, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140063598
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140045950
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a1e40
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140063af0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, qword [0x1401146d0]
cmp byte [rbx + 0x7c], 0
jne 0x140063b20
lea rdx, [0x1400b1c89]
mov rcx, rsi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
lea rcx, [rbx + 0x5f90]
movsxd r14, dword [rbx + 0x5f90]
and eax, 0xfffffffc
lea edx, [rax + r14]
add edx, 0x18
mov ebp, eax
add ebp, 0x18
call fcn.140045750
mov rax, qword [rbx + 0x5f98]
mov dword [rax + r14], ebp
mov rax, qword [rbx + 0x5f98]
lea rcx, [rax + r14]
lea rbx, [rax + r14]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r14 + 4], xmm0
test rdi, rdi
je 0x140063be6
lea rax, [rdi - 1]
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x1400a5760]
mov r11d, 0xffffffff
jmp 0x140063bc6
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
add rax, 0xffffffffffffffff
jae 0x140063c50
movzx r10d, byte [rdx - 2]
cmp rax, 2
jb 0x140063ba0
cmp r10b, 0x23
jne 0x140063ba0
cmp byte [rdx - 1], 0x23
jne 0x140063ba0
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x140063ba0
movzx eax, byte [rsi]
test al, al
je 0x140063c4a
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x1400a5760]
mov r11d, 0xffffffff
jmp 0x140063c30
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
test al, al
je 0x140063c50
mov r10d, eax
movzx eax, byte [rdx - 1]
cmp r10b, 0x23
jne 0x140063c10
cmp al, 0x23
jne 0x140063c10
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x140063c10
mov r10d, 0xffffffff
not r10d
mov dword [rcx + 4], r10d
add rcx, 0x14
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14006d930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
vmovaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0x90]
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x21
add eax, ecx
shl eax, 2
movsxd rcx, eax
call fcn.1400441c0
mov r14, rax
movzx ecx, byte [rbx]
test cl, cl
je 0x14006da39
add rbx, 5
mov rax, r14
nop word [rax + rax]
movsx edx, cl
xor ecx, ecx
cmp dl, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, edx
movsx r8d, byte [rbx - 4]
xor edx, edx
cmp r8d, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, r8d
movsx r9d, byte [rbx - 3]
xor r8d, r8d
cmp r9d, 0x5c
setge r8b
xor r8d, 0xffffffdd
add r8d, r9d
movsx r9d, byte [rbx - 2]
xor r10d, r10d
cmp r9d, 0x5c
setge r10b
xor r10d, 0xffffffdd
add r10d, r9d
movsx r9d, byte [rbx - 1]
xor r11d, r11d
cmp r9d, 0x5c
setge r11b
xor r11d, 0xffffffdd
add r11d, r9d
imul r9d, r11d, 0x55
add r9d, r10d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
imul edx, r8d, 0x55
add edx, ecx
mov dword [rax], edx
add rax, 4
movzx ecx, byte [rbx]
add rbx, 5
test cl, cl
jne 0x14006d9a0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r14
vmovaps xmm3, xmm6
call fcn.14006dbb0
mov rsi, rax
mov rcx, r14
call fcn.140044450
mov rax, rsi
vmovaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140090570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov r14d, edx
mov ebp, edx
sar ebp, 0x1f
and ebp, edx
dec ebp
mov r15d, 0xfffffffe
add r15, r14
dec r14
jmp 0x1400905c9
call fcn.140090c50
or r13b, bl
and r13b, r12b
xor bl, 1
movzx ecx, r13b
movzx edx, bl
test al, al
cmove edx, ecx
movzx eax, dl
dec r15
dec esi
dec r14
test eax, eax
jne 0x14009063d
test esi, esi
jle 0x14009063b
xor eax, eax
test r14d, r14d
je 0x1400905bd
mov ecx, dword [rdi + 0xe88]
mov edx, 0x8000
and ecx, edx
jne 0x1400905bd
mov r12, qword [rdi + 0x20]
mov eax, r15d
movzx ecx, word [r12 + rax*2]
mov r13b, 1
cmp ecx, 9
je 0x140090607
cmp ecx, 0x20
je 0x140090607
cmp ecx, 0x3000
je 0x140090607
xor r13d, r13d
call fcn.140090c50
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x1400905a0
cmp ecx, 0x20
je 0x1400905a0
cmp ecx, 0x3000
je 0x1400905a0
mov r12b, 1
jmp 0x1400905a0
mov esi, ebp
mov eax, esi
sar eax, 0x1f
andn eax, eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140090660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x59], 0
mov esi, dword [rcx + 0xc]
je 0x140090725
inc edi
cmp edi, esi
jge 0x1400907d8
mov r14d, dword [rbx + 0xe88]
jmp 0x1400906c8
or r15b, al
call fcn.140090c50
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x1400907d8
inc edi
cmp esi, edi
je 0x1400907d1
test r14w, r14w
js 0x1400906be
mov r12d, edi
dec r12d
js 0x1400906be
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x1400906fa
cmp ecx, 0x20
je 0x1400906fa
cmp ecx, 0x3000
je 0x1400906fa
mov r15b, 1
call fcn.140090c50
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x1400906a0
cmp ecx, 0x20
je 0x1400906a0
cmp ecx, 0x3000
je 0x1400906a0
xor eax, eax
jmp 0x1400906a0
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x140090763
call fcn.140090c50
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x1400907d8
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x1400907d5
xor ecx, ecx
test eax, eax
js 0x14009075f
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x14009075f
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x1400907a1
cmp ecx, 0x20
je 0x1400907a1
cmp ecx, 0x3000
je 0x1400907a1
xor r12d, r12d
call fcn.140090c50
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x140090740
cmp ecx, 0x20
je 0x140090740
cmp ecx, 0x3000
je 0x140090740
mov r13b, 1
jmp 0x140090740
mov edi, esi
jmp 0x1400907d8
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140091120
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx r15d, byte [r8 + 3]
xor r15, rcx
imul r15, rax
mov rcx, qword [rdi + 0x30]
and rcx, r15
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov rbx, qword [rdx + rax + 8]
cmp rbx, qword [rdi + 8]
je 0x1400911c5
mov eax, dword [r14]
cmp eax, dword [rbx + 0x10]
je 0x1400911be
add rcx, rcx
mov r12, qword [rdx + rcx*8]
nop word cs:[rax + rax]
cmp rbx, r12
je 0x1400911c8
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1400911b0
xor eax, eax
jmp 0x140091350
mov r12, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x140091368
mov ecx, 0x18
call fcn.1400a1c64
mov rbx, rax
mov ebp, dword [r14]
mov dword [rax + 0x10], ebp
mov byte [rax + 0x14], 0
mov rax, qword [rdi + 0x10]
inc rax
js 0x140091203
vcvtsi2ss xmm0, xmm0, rax
jmp 0x140091218
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
vmovss xmm1, dword [rdi]
mov rdx, qword [rdi + 0x38]
test rdx, rdx
js 0x14009122c
vcvtsi2ss xmm2, xmm2, rdx
jmp 0x140091243
mov rax, rdx
shr rax, 1
mov ecx, edx
and ecx, 1
or rcx, rax
vcvtsi2ss xmm2, xmm2, rcx
vaddss xmm2, xmm2, xmm2
vdivss xmm2, xmm0, xmm2
vucomiss xmm2, xmm1
jbe 0x1400912fa
vdivss xmm0, xmm0, xmm1
vroundss xmm0, xmm0, xmm0, 0xa
vcvttss2si rax, xmm0
mov rcx, rax
vsubss xmm0, xmm0, dword [0x1400af670]
vcvttss2si r8, xmm0
sar rcx, 0x3f
and r8, rcx
or r8, rax
cmp r8, 9
mov eax, 8
cmovae rax, r8
cmp rdx, rax
jae 0x1400912a9
lea rcx, [rdx*8]
cmp rcx, rax
cmovb rcx, rax
cmp rdx, 0x200
cmovae rcx, rax
mov rdx, rcx
mov rcx, rdi
call fcn.140091380
mov rax, qword [rdi + 0x30]
and rax, r15
mov rcx, qword [rdi + 0x18]
mov rdx, rax
shl rdx, 4
mov r12, qword [rcx + rdx + 8]
cmp r12, qword [rdi + 8]
je 0x1400912fa
cmp ebp, dword [r12 + 0x10]
je 0x1400912f1
add rax, rax
mov rax, qword [rcx + rax*8]
nop dword [rax]
cmp r12, rax
je 0x1400912f7
mov r12, qword [r12 + 8]
cmp ebp, dword [r12 + 0x10]
jne 0x1400912e0
mov r12, qword [r12]
jmp 0x1400912fa
mov r12, rax
mov rcx, qword [r12 + 8]
inc qword [rdi + 0x10]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [r12 + 8], rbx
mov rax, qword [rdi + 0x18]
and r15, qword [rdi + 0x30]
shl r15, 4
lea rdx, [rax + r15]
lea r8, [rax + r15]
add r8, 8
mov rax, qword [rax + r15]
cmp rax, qword [rdi + 8]
je 0x140091345
cmp rax, r12
je 0x14009134b
mov al, 1
mov rdx, r8
cmp qword [r8], rcx
jne 0x140091350
jmp 0x14009134b
mov qword [rdx], rbx
mov rdx, r8
mov qword [rdx], rbx
mov al, 1
mov qword [rsi], rbx
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140097f40
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rdx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140098000
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140097f9e
mov rdx, qword [rdi]
lea r14, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140097fe8
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
jmp 0x140097fca
mov rcx, r14
call r12
test eax, eax
je 0x140097fe8
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140097ff7
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140097fc0
mov rdx, qword [rdi]
jmp 0x140097fc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x140098000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400a1e40
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140099790
Capabilities:
Get uefi variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, r9
mov rbx, r8
mov rsi, rcx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], 4
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
lea r15, [rsp + 0x30]
mov qword [rsp + 0x58], r15
mov rbp, qword gs:[0x30]
lea r12, [rsp + 0x38]
mov qword [rbp + 0x870], r12
mov qword [rbp + 0x858], 0xdead
mov qword [rbp + 0x860], 0x8461028
mov qword [rbp + 0x5b8], rax
lea rdx, str.SecureBoot
lea r14, [rsp + 0x70]
mov rcx, r14
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x6f], 0
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x64], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x6f]
lea r9, [rsp + 0x68]
mov rcx, r14
mov rdx, rsi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rbp + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [rbp + 0x870], 0
mov qword [rbp + 0x5b8], 0
mov rax, qword [rsi + 0x270]
test rax, rax
je 0x140099a28
mov rcx, qword [rsi + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x58], r15
mov rbp, qword gs:[0x30]
mov qword [rbp + 0x870], r12
mov qword [rbp + 0x858], 0xdead
mov qword [rbp + 0x860], 0x8461028
mov qword [rbp + 0x5b8], rcx
lea rbx, str.SecureBoot
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x6f], 0
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x6f]
lea r9, [rsp + 0x68]
mov rcx, r14
mov rdx, rsi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rbp + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [rbp + 0x870], 0
mov qword [rbp + 0x5b8], 0
mov rax, qword [rsp + 0xf0]
mov qword [rax], rdi
mov rax, qword [rsi + 0x270]
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x58], r15
mov r14, qword gs:[0x30]
mov qword [r14 + 0x870], r12
mov qword [r14 + 0x858], 0xdead
mov qword [r14 + 0x860], 0x8461028
mov qword [r14 + 0x5b8], rcx
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0x6f], 0
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x6f]
lea r9, [rsp + 0x68]
mov rcx, rdi
mov rdx, rsi
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [r14 + 0x5b8]
mov qword [rsi + 0x270], rax
mov qword [r14 + 0x870], 0
mov qword [r14 + 0x5b8], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a1e40
xor eax, eax
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140099b10
Capabilities:
Get uefi variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0x7ffffffffffe
cmp rdx, rax
ja 0x140099ccb
mov r15, rcx
cmp qword [rcx + 0x18], 0
je 0x140099ccb
mov rdi, r9
mov sil, 1
test r9, r9
je 0x140099ccd
mov rbx, r8
mov r14, rdx
xor r12d, r12d
lea rbp, [rsp + 0xb0]
nop word cs:[rax + rax]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x50], ymm0
vmovups ymmword [rsp + 0x30], ymm0
mov r9, qword [r15 + 0x18]
lea r8, [r12 + r14]
mov rcx, r15
lea rdx, [rsp + 0x30]
vzeroupper
call fcn.140098e50
test rax, rax
je 0x140099ccb
mov ecx, eax
and ecx, 0xfff
mov r13d, 0x1000
sub r13, rcx
cmp rdi, r13
cmovb r13, rdi
lea rcx, [r12 + rbx]
mov rdx, qword [r15 + 0x38]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
mov rsi, qword gs:[0x30]
lea rax, [rsp + 0x78]
mov qword [rsi + 0x870], rax
mov qword [rsi + 0x858], 0xdead
mov qword [rsi + 0x860], 0x8461028
mov qword [rsi + 0x5b8], rdx
mov rcx, rbp
lea rdx, str.SecureBoot
call sub.ntdll.dll_RtlInitUnicodeString
mov byte [rsp + 0xaf], 0
mov dword [rsp + 0xa8], 1
mov dword [rsp + 0xa4], 0
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, r15
lea r8, [rsp + 0xaf]
lea r9, [rsp + 0xa8]
call sub.ntdll.dll_NtQuerySystemEnvironmentValueEx
mov rax, qword [rsi + 0x5b8]
mov qword [r15 + 0x270], rax
mov qword [rsi + 0x870], 0
mov qword [rsi + 0x5b8], 0
cmp qword [rsp + 0x70], r13
jne 0x140099cc6
add r12, r13
sub rdi, r13
jne 0x140099b80
mov sil, 1
jmp 0x140099ccd
xor esi, esi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400a1e40
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009f7b0
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc28
mov rcx, r8
mov rsi, rdx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0xc20], rax
lea rdi, [rsp + 0x420]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rbx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov rcx, rbx
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14009f8ca
mov rdi, rax
cmp rax, 0xf
ja 0x14009f848
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
jmp 0x14009f8a7
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x14009f87d
lea rcx, [r14 + 0x28]
call fcn.1400a1c64
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14009f889
lea rcx, [r14 + 1]
call fcn.1400a1c64
mov rbx, rax
mov qword [rsi], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.1400a1e40
mov rax, rsi
add rsp, 0xc28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140006a40
int3