joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1405e2e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [fcn.1405eac00]
mov rbx, rax
test rax, rax
jne 0x1405e2e75
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x50], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x1405e2ec0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + 8]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + 0x10]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x1405e2f22
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rbp + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + 8]
sub r15, 1
jne 0x1405e2ee0
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x1405e2f63
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1406212f1]
mov r8d, 1
call qword [rbp + 8]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1406212f2]
mov r8d, 1
call qword [rbp + 8]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1405e2f30
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x1405e2f80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r12, r9
mov rcx, r8
mov r14, rdx
call fcn.1400ab3a0
mov r8d, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
call qword [fcn.1405eac00]
mov rbx, rax
test rax, rax
je 0x1405e3126
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x1405e3010
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + 8]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + 0x10]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x1405e3072
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [rbp + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + 8]
sub r15, 1
jne 0x1405e3030
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x1405e30b3
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1406212f1]
mov r8d, 1
call qword [rbp + 8]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1406212f2]
mov r8d, 1
call qword [rbp + 8]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1405e3080
mov rcx, qword [rsp + 0x70]
call fcn.1400ab3a0
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + 8]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
test rdi, rdi
jne 0x1405e30e2
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + 0x10]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + 8]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + 0x10]
mov rcx, rbx
call qword [fcn.1405ea4b4]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret

Function at 0x1405e4990
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1405e49f5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x1405e49a0
ret

Function at 0x1405f1c1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1405f1a2c
Function at 0x1405f7e20
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140662038]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140626730]
mov rbp, rcx
call fcn.140603e88
xor edi, edi
test rax, rax
je 0x1405f7f06
mov ebx, edi
call fcn.14004331c
mov r14d, dword [rax]
call fcn.14004331c
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.14006d298
mov rsi, rax
test rax, rax
je 0x1405f7e97
call fcn.14004331c
mov dword [rax], r14d
jmp 0x1405f7ec1
call fcn.14004331c
cmp dword [rax], 0x22
jne 0x1405f7efe
call fcn.14004331c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.14006d298
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1405f7efe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1405f7ec5
cmp rax, 3
je 0x1405f7ee0
mov rcx, rsi
call fcn.1405f7d68
test al, al
je 0x1405f7ef1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1405f7ef1
mov dil, 1
mov rcx, rbx
call fcn.1405ea4b4
mov al, dil
jmp 0x1405f7f08
mov rcx, rbx
call fcn.1405ea4b4
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140579eb0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1405f96a8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140579ee0
sub rsp, rax
mov rax, qword [0x140662038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140077ee8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1405f96f7
mov rax, rbp
jmp 0x1405f97ff
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x99af10]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140071044
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x99af10]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1405f97fb
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1405f97fb
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140071044
test rax, rax
js 0x1405f97fb
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1405f97fb
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1405f97ed
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1405f97ed
cmp byte [rcx], 0xd
jne 0x1405f97d3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1405f97e2
cmp byte [rcx + 1], 0xa
jne 0x1405f97e2
inc rcx
jmp 0x1405f97e2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x6630f0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1405f97b5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1405f97ff
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140579eb0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140605380
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14099af10]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1406053de
cmp word [rdx], r12w
jne 0x1406053de
or byte [rax + r8*8 + 0x38], cl
jmp 0x1406053e4
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14060553f
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14060551a
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14060541d
mov rcx, r9
jmp 0x140605440
cmp r9, rdx
jae 0x140605457
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140605401
jmp 0x14060553f
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140605514
cmp dword [rsp + 0x80], edi
je 0x140605514
mov rdx, r14
lea r11, [0x14099af10]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1406054ed
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1406054c0
mov word [rbx], r12w
jmp 0x14060553b
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1406054c9
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14060553b
cmp word [rsp + 0x70], r12w
jne 0x1406054fa
cmp rbx, rsi
je 0x1406054ba
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140095f70
cmp word [rsp + 0x70], r12w
je 0x14060553f
mov word [rbx], r13w
jmp 0x14060553b
lea r11, [0x14099af10]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140605537
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14060553f
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x141033058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1410331df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141033089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14103306f
add dl, dl
jne 0x141033096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410330f6
xor eax, eax
add dl, dl
jne 0x1410330a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410331ad
add dl, dl
jne 0x1410330b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410330c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410330d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410330dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410330ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14103307e
mov eax, 1
add dl, dl
jne 0x141033106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141033113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410330fb
sub eax, ebx
mov ebx, 1
jne 0x14103314c
mov ecx, 1
add dl, dl
jne 0x14103312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14103313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141033123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141033168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141033175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14103315d
cmp eax, 0x7d00
jae 0x14103319b
cmp eax, 0x500
jb 0x141033196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103307e
cmp eax, 0x7f
ja 0x14103319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410331d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14103307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140838058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408381df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140838089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083806f
add dl, dl
jne 0x140838096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408380f6
xor eax, eax
add dl, dl
jne 0x1408380a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408381ad
add dl, dl
jne 0x1408380b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408380c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408380d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408380dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408380ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14083807e
mov eax, 1
add dl, dl
jne 0x140838106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140838113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408380fb
sub eax, ebx
mov ebx, 1
jne 0x14083814c
mov ecx, 1
add dl, dl
jne 0x14083812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140838123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140838168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140838175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083815d
cmp eax, 0x7d00
jae 0x14083819b
cmp eax, 0x500
jb 0x140838196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083807e
cmp eax, 0x7f
ja 0x14083819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408381d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14083807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000e654
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1400b3010]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rcx, rdx
mov rbx, r8
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x410
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbx]
cmp dword [r8 + 4], 0
je 0x14000e6cf
mov rcx, rbx
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r9, rdi
lea r8, str.__s___s
lea rcx, [rbp]
mov qword [rsp + 0x20], rax
mov edx, 0x410
call fcn.140003ffc
and qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e7ff
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
and qword [rsp + 0x68], 0
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x20f01ff
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
and qword [rsp + 0x70], 0
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor edx, edx
movups xmmword [rsp + 0x78], xmm0
lea ebx, [rax + 0x70]
mov r8d, ebx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rbp - 0x60], rax
lea r8, [rbp]
lea rax, [rsp + 0x78]
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov rdx, rdi
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x628
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne bl
test eax, eax
je 0x14000e7d6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test bl, bl
je 0x14000e7ff
mov al, 1
jmp 0x14000e801
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140016760
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x415540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4156eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4155ae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4155c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4155e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4155f9
cmp rbx, 0x1000
jae 0x4155b8
nop
jmp 0x415669
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41560d
xor edx, edx
jmp 0x415660
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4155ef
jmp 0x4155d5
call fcn.0045fe20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004362e0
lea rax, [0x004ac63c]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00436be0
mov rax, qword [rsp + 0x38]
call fcn.004368e0
lea rax, [0x004ac6fc]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436be0
mov rax, qword [rsp + 0x30]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004ae89a]
mov ebx, 0x21
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415540
Function at 0x415720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431da0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41579b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4157ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4157d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4157e4
cmp rbx, 0x1000
jae 0x4157a5
jmp 0x41586e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4157f6
xor esi, esi
jmp 0x415860
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431da0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4157da
jmp 0x4157c2
call fcn.0045fe20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4158e9
call fcn.004362e0
lea rax, [0x004acab2]
mov ebx, 0x19
call fcn.00436be0
mov rax, qword [rsp + 0x68]
call fcn.004368e0
lea rax, [0x004ac6fc]
mov ebx, 0x19
nop
call fcn.00436be0
mov eax, dword [rsp + 0x34]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004a9712]
mov ebx, 0xd
call fcn.00434a20
cmp eax, 0x5af
je 0x415893
call fcn.004362e0
lea rax, [0x004acab2]
mov ebx, 0x19
call fcn.00436be0
mov rax, qword [rsp + 0x38]
call fcn.004368e0
lea rax, [0x004ac6fc]
mov ebx, 0x19
nop dword [rax]
call fcn.00436be0
mov eax, dword [rsp + 0x34]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004ae1ac]
mov ebx, 0x1f
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415720