joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e344
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14004e40a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x14004e3d5
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x14004e38a
test rbx, rbx
je 0x14004e3f2
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14004e3e0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14004e40c
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004e4b9
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x14004e491
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14004e449
test rbx, rbx
je 0x14004e4a7
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14004e499
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400543fc
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x14005444b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140054422
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x14005571c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140055766
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140055766
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140055766
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140055766
cmp dword [rcx + 0x84], 0xe
jbe 0x140055766
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140055768
xor al, al
add rsp, 0x28
ret
Function at 0x14001141a
Capabilities:
Terminate process

Disassembly:
jmp 0x14001b8b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011505
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1400185c0
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002e0f3]
call fcn.140011712
lea rdx, [0x1400238b8]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
lea rcx, [rbp + 8]
call fcn.140011703
nop
xor eax, eax
cmp eax, 1
je 0x1400186aa
lea rdx, [0x140023900]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110e1
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011037
lea rdx, [0x1400284f0]
lea rcx, [rbp + 8]
call fcn.1400111ea
movzx eax, al
test eax, eax
je 0x140018682
lea rdx, [0x140023940]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110e1
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400186aa
lea rdx, [0x140023980]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110e1
lea rdx, [0x14001105f]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140018616
xor eax, eax
cmp eax, 1
je 0x1400186cd
xor edx, edx
lea rcx, [0x140011028]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400186aa
mov dword [rbp + 0x104], 0
lea rcx, [rbp + 8]
call fcn.14001115e
mov eax, dword [rbp + 0x104]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140023310]
call fcn.1400115f5
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140011375
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x14001151e
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ac70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ac90
xor al, al
jmp 0x14001ad11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001aca3
xor al, al
jmp 0x14001ad11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001accd
xor al, al
jmp 0x14001ad11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ace1
xor al, al
jmp 0x14001ad11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001acf3
xor al, al
jmp 0x14001ad11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ad0f
xor al, al
jmp 0x14001ad11
mov al, 1
add rsp, 0x38
ret
Function at 0x140002c00
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [0x140025068], 0
mov rbx, rcx
mov dword [rsp + 0x38], 0xffffffff
je 0x140002c2a
lea rcx, [rsp + 0x38]
call qword [0x140025300]
test eax, eax
jne 0x140002c32
mov dword [rsp + 0x38], 0xffffffff
mov rcx, rbx
call fcn.140002790
cmp dword [rsp + 0x38], 0xc
jne 0x140002c6f
lea rcx, str.aps:pause_is_down
call fcn.140017c00
lea rcx, [0x140002bb0]
mov r8, rbx
xor edx, edx
mov dword [rbx + 0xed8], 1
call qword [sym.imp.MSVCR110.dll__beginthread]
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0xed8], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140007380
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, r8w
mov rbx, rcx
cmp eax, 0xf120
jne 0x140007434
mov eax, dword [rcx + 0xe0]
cmp eax, 1
jne 0x1400073c6
mov rcx, qword [rcx + 0x90]
lea edx, [rax + 4]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.140008940
xor edi, edi
jmp 0x1400074b1
test eax, eax
jne 0x140007421
mov rcx, qword [rcx + 0x90]
lea edx, [rax + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [rbx + 0x1a60], 0
je 0x1400073ec
mov rcx, rbx
call fcn.140008800
mov rcx, qword [rbx + 0x3918]
mov edx, 5
mov dword [rbx + 0x3bc8], 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x3c50]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
jmp 0x1400074b1
cmp qword [rcx + 0x1a60], 0
je 0x140007430
call fcn.140008800
xor edi, edi
jmp 0x1400074b1
xor edi, edi
cmp eax, 0xf020
jne 0x1400074a8
mov dword [rcx + 0x5368], edi
call fcn.140008430
mov eax, dword [rbx + 0xe0]
cmp eax, 1
jne 0x140007486
mov rcx, rbx
call fcn.140008800
mov rcx, qword [rbx + 0x90]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 8]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test eax, eax
jne 0x14000746a
mov rcx, qword [rbx + 0x3918]
xor edx, edx
mov dword [rbx + 0x3bc8], edi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x3c50]
jmp 0x140007462
cmp eax, 0xf100
sete dil
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
mov dword [rax], edi
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400074d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0x80]
mov rdi, rcx
mov rcx, qword [rcx + 8]
movzx esi, r9w
xor ebp, ebp
shr r9, 0x10
lea rdx, [rsp + 0x20]
movzx ebx, r9w
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
movss xmm2, dword [0x140025278]
movd xmm1, ebx
sub eax, dword [rsp + 0x20]
movaps xmm0, xmm2
cvtdq2ps xmm1, xmm1
mulss xmm0, dword [0x14001c258]
comiss xmm1, xmm0
jbe 0x14000767a
movaps xmm0, xmm2
mulss xmm0, dword [0x14001c344]
comiss xmm0, xmm1
jbe 0x14000767a
movss xmm5, dword [0x14001c36c]
movd xmm3, eax
movaps xmm0, xmm2
mulss xmm0, dword [0x14001c39c]
movd xmm4, esi
cvtdq2ps xmm3, xmm3
movaps xmm1, xmm3
cvtdq2ps xmm4, xmm4
subss xmm1, xmm0
comiss xmm4, xmm1
jbe 0x14000760e
movaps xmm1, xmm2
movaps xmm0, xmm3
mulss xmm1, xmm5
subss xmm0, xmm1
comiss xmm0, xmm4
jbe 0x14000760e
mov rcx, rdi
mov dword [rdi + 0x5368], ebp
call fcn.140008430
mov eax, dword [rdi + 0xe0]
cmp eax, 1
jne 0x1400075d5
mov rcx, rdi
call fcn.140008800
mov rcx, qword [rdi + 8]
lea edx, [rbp + 6]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000767a
test eax, eax
jne 0x1400075fd
mov rcx, qword [rdi + 0x3918]
xor edx, edx
mov dword [rdi + 0x3bc8], ebp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 0x3c50]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000767a
movaps xmm1, xmm2
movaps xmm0, xmm3
mulss xmm1, xmm5
subss xmm0, xmm1
comiss xmm4, xmm0
jb 0x14000767a
mulss xmm2, dword [0x14001c324]
subss xmm3, xmm2
comiss xmm3, xmm4
jb 0x14000767a
mov rcx, qword [rdi + 0x7d8]
test rcx, rcx
je 0x140007666
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp qword [rdi + 0x7d8], rbp
je 0x140007666
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rdi + 0x7d8], rbp
jne 0x140007652
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [r14], ebp
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018cd0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140008330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r8, [0x14001abc8]
mov edx, 0x6a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140008361
lea rcx, [rbx + 0x5148]
mov rdx, rax
call fcn.1400169f0
lea r8, [0x14001abc8]
mov edx, 0x8f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140008389
lea rcx, [rbx + 0x5150]
mov rdx, rax
call fcn.1400169f0
lea r8, [0x14001abc8]
mov edx, 0x94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400083b1
lea rcx, [rbx + 0x5158]
mov rdx, rax
call fcn.1400169f0
mov rcx, qword [rbx + 0x80]
mov edx, 0x132
lea r8, [rbx + 0x5160]
lea r9d, [rdx - 0x2e]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [0x14001abc8]
mov edx, 0x8e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400083f6
lea rcx, [rbx + 0x5370]
mov rdx, rax
call fcn.1400169f0
lea r8, [0x14001abc8]
mov edx, 0x93
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140008423
lea rcx, [rbx + 0x5378]
mov rdx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400169f0
add rsp, 0x20
pop rbx
ret

Function at 0x140008800
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1a60]
test rcx, rcx
je 0x14000892b
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2e08]
xor edx, edx
mov dword [rbx + 0x2940], 0
mov dword [rbx + 0x2e68], 0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2e80]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x31c0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x3500]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2998]
test rcx, rcx
je 0x1400088ad
xor edx, edx
mov dword [rbx + 0x29e8], 0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2a10]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2d50]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x1ab8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x1b10]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x1e58]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2198]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x2818]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x28b0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x24d8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x3870]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x20
pop rbx
ret
Function at 0x140008d40
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x70], rax
movss xmm3, dword [0x140025278]
mov rbp, rcx
lea rdx, [rsp + 0x60]
movaps xmm0, xmm3
movaps xmm1, xmm3
movaps xmm2, xmm3
mulss xmm3, dword [0x14001c490]
mulss xmm0, dword [0x14001c3a8]
mulss xmm1, dword [0x14001c338]
mulss xmm2, dword [0x14001c4c0]
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ecx
cvtdq2ps xmm0, xmm0
addss xmm2, xmm0
movd xmm0, ecx
lea rcx, [rbp + 0x7c8]
cvttss2si eax, xmm2
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x68], eax
addss xmm3, xmm0
cvttss2si eax, xmm3
mov dword [rsp + 0x6c], eax
call qword [sym.imp.USER32.dll_CopyRect]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140008e0e
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_ClientToScreen]
movss xmm3, dword [0x140025278]
movd xmm0, dword [rsp + 0x54]
mov rdi, qword [rbp + 8]
movaps xmm1, xmm3
movaps xmm2, xmm3
lea r9, [rbp + 0x7c0]
lea r8, [0x140023f00]
cvtdq2ps xmm0, xmm0
mulss xmm1, dword [0x14001c3a8]
mulss xmm2, dword [0x14001c338]
addss xmm1, xmm0
movd xmm0, dword [rsp + 0x50]
cvtdq2ps xmm0, xmm0
cvttss2si ecx, xmm1
movaps xmm1, xmm3
mulss xmm3, dword [0x14001c490]
mulss xmm1, dword [0x14001c4c0]
mov dword [rsp + 0x54], ecx
addss xmm2, xmm0
cvttss2si eax, xmm2
movd xmm0, eax
mov dword [rsp + 0x50], eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movd xmm0, ecx
cvttss2si eax, xmm1
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x58], eax
addss xmm3, xmm0
cvttss2si eax, xmm3
mov dword [rsp + 0x5c], eax
call fcn.140005e30
lea r8, [rsp + 0x50]
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], 0
lea rcx, [rbp + 0x780]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call fcn.140005c00
mov rcx, qword [rbp + 0x788]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140018cd0
lea r11, [rsp + 0x80]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008f10
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x70], rax
movss xmm3, dword [0x140025278]
mov rbp, rcx
lea rdx, [rsp + 0x60]
movaps xmm0, xmm3
movaps xmm1, xmm3
movaps xmm2, xmm3
mulss xmm3, dword [0x14001c494]
mulss xmm0, dword [0x14001c3a8]
mulss xmm1, dword [0x14001c370]
mulss xmm2, dword [0x14001c4bc]
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ecx
cvtdq2ps xmm0, xmm0
addss xmm2, xmm0
movd xmm0, ecx
lea rcx, [rbp + 0x38f8]
cvttss2si eax, xmm2
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x68], eax
addss xmm3, xmm0
cvttss2si eax, xmm3
mov dword [rsp + 0x6c], eax
call qword [sym.imp.USER32.dll_CopyRect]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140008fde
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_ClientToScreen]
movss xmm3, dword [0x140025278]
movd xmm0, dword [rsp + 0x54]
mov rdi, qword [rbp + 8]
movaps xmm1, xmm3
movaps xmm2, xmm3
lea r9, [rbp + 0x1a98]
lea r8, [0x140023e00]
cvtdq2ps xmm0, xmm0
mulss xmm1, dword [0x14001c3a8]
mulss xmm2, dword [0x14001c370]
addss xmm1, xmm0
movd xmm0, dword [rsp + 0x50]
cvtdq2ps xmm0, xmm0
cvttss2si eax, xmm1
movaps xmm1, xmm3
mulss xmm3, dword [0x14001c494]
mulss xmm1, dword [0x14001c4bc]
mov dword [rsp + 0x54], eax
addss xmm2, xmm0
movd xmm0, dword [rsp + 0x60]
cvtdq2ps xmm0, xmm0
cvttss2si eax, xmm2
mov dword [rsp + 0x50], eax
addss xmm1, xmm0
movd xmm0, dword [rsp + 0x64]
cvttss2si eax, xmm1
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x58], eax
addss xmm3, xmm0
cvttss2si eax, xmm3
mov dword [rsp + 0x5c], eax
call fcn.140005e30
lea r8, [rsp + 0x50]
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], 0
lea rcx, [rbp + 0x1a58]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call fcn.140005c00
mov rcx, qword [rbp + 0x1a60]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140018cd0
lea r11, [rsp + 0x80]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400090f0
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x60], rax
movss xmm3, dword [0x140025278]
mov rbp, rcx
lea rdx, [rsp + 0x50]
movaps xmm0, xmm3
movaps xmm1, xmm3
movaps xmm2, xmm3
mulss xmm3, dword [0x14001c368]
mulss xmm0, dword [0x14001c350]
mulss xmm1, dword [0x14001c32c]
mulss xmm2, dword [0x14001c4c4]
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movd xmm0, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], ecx
cvtdq2ps xmm0, xmm0
addss xmm2, xmm0
movd xmm0, ecx
lea rcx, [rbp + 0xf4]
cvttss2si eax, xmm2
cvtdq2ps xmm0, xmm0
mov dword [rsp + 0x58], eax
addss xmm3, xmm0
cvttss2si eax, xmm3
mov dword [rsp + 0x5c], eax
call qword [sym.imp.USER32.dll_CopyRect]
mov rdi, qword [rbp + 8]
lea rax, [rbp + 0x68]
lea r9, [rbp + 0xc8]
lea r8, [0x140024000]
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0xf0], 0x6b
call fcn.140005e30
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x88]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call fcn.140005c00
lea rcx, [rbp + 0x88]
call fcn.140017490
mov rcx, qword [rbp + 0x90]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140018cd0
lea r11, [rsp + 0x70]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000a2d0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x20], VarUI4FromDisp
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000a341
mov eax, dword [rsp + 0x24]
cmp eax, 5
jae 0x14000a327
cmp eax, 4
jne 0x14000a341
cmp dword [rsp + 0x28], 0x5a
jb 0x14000a341
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018cd0
add rsp, 0x158
ret
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018cd0
add rsp, 0x158
ret

Function at 0x14000a360
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x20], VarUI4FromDisp
call sub.MSVCR110.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000a3c3
cmp dword [rsp + 0x24], 6
jb 0x14000a3c3
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018cd0
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140018cd0
add rsp, 0x158
ret
Function at 0x14000c340
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140023020]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
xor ecx, ecx
xor r8d, r8d
mov edi, dword [rsi + 8]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi]
or edi, 0x2001f
mov r9d, edi
mov qword [rsp + 0x70], rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14000c497
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c3c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x14000c497
xor edi, edi
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000c46f
nop word [rax + rax]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14000c340
mov ebx, eax
test eax, eax
jne 0x14000c497
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000c420
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c484
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.14000c620
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c4a7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140018cd0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret