joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003be4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003be96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003be96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003be96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003be96
cmp dword [rcx + 0x84], 0xe
jbe 0x14003be96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003be98
xor al, al
add rsp, 0x28
ret

Function at 0x14003c104
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003c188
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x14003c188
dec r8
sub rdx, 1
jne 0x14003c16e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14003f3a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x1c0], 0
je 0x14003f3bc
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax + 0x178]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140059650
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
movzx ecx, word [rcx]
test cx, cx
je 0x14005967f
nop dword [rax]
movzx edx, cx
lea r8, [r8 + 2]
add edx, eax
imul eax, edx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [r8]
test cx, cx
jne 0x140059660
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x140059d30
Capabilities:
Print debug messages

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov dword [rbp - 0x59], 0
lea rcx, [rbp - 0x49]
call fcn.14003d6e0
mov dword [rbp - 0x59], 1
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140059d82
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rax, qword [rbp - 0x49]
cmp word [rax + rcx*2 - 2], 0xa
je 0x140059d97
mov dword [rbp - 0x51], 0xa
mov edx, 0xa
lea rcx, [rbp - 0x49]
call fcn.140046cd0
lea rdx, [0x14033e948]
lea rcx, [rbp + 0x17]
call fcn.1400476b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x37], xmm0
lea rdx, [0x14033e95c]
lea rcx, [rbp - 0x19]
call fcn.1400476b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov r9b, 1
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x49]
call fcn.140045560
nop
mov rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x19]
call fcn.1400119a0
nop
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x17]
call fcn.1400119a0
lea rdx, [0x14033e960]
lea rcx, [rbp - 0x19]
call fcn.1400476b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
lea rdx, reloc.WS2_32.dll_ioctlsocket
lea rcx, [rbp + 0x17]
call fcn.1400476b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x37], xmm0
mov r9b, 1
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x49]
call fcn.140045560
nop
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x17]
call fcn.1400119a0
nop
mov rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x19]
call fcn.1400119a0
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x49]
call fcn.1400119a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14003b100
add rsp, 0xd0
pop rbp
ret
Function at 0x140059eb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
mov r8, rdx
lea rdx, [rsp + 0x40]
add rcx, 8
call fcn.1400596e0
nop
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp rax, 2
jne 0x140059f6a
lea rdx, [0x14033e940]
lea rcx, [rsp + 0xa0]
call fcn.140010ee0
nop
lea rdx, [0x14033e944]
lea rcx, [rsp + 0x70]
call fcn.140010ee0
nop
mov r9b, 1
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140045560
nop
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x70]
call fcn.1400119a0
nop
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0xa0]
call fcn.1400119a0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov r9, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 8]
call fcn.140048260
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1400119a0
mov rcx, qword [rsp + 0x20]
mov r9, qword [rdi + 0x10]
mov r8d, 1
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
nop
call fcn.140044e20
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x14005a02b
mov eax, 0xffff
add word [rcx + 0x10], ax
jne 0x14005a025
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x14005a025
cmp byte [rbx + 0x12], 0
je 0x14005a018
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14003b258
call fcn.140044e20
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14003b100
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x14005aae0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1404f1d08]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1404c4b08], eax
jg 0x14005ab31
lea rax, [0x1404c4ad8]
add rsp, 0x28
ret
mov dword [0x1404c4b00], eax
lea rcx, [0x1404c4b08]
call fcn.1402d0938
lea rax, [0x1404c4ad8]
add rsp, 0x28
ret
lea rcx, [0x1404c4b08]
call fcn.1402d09a4
cmp dword [0x1404c4b08], 0xffffffff
jne 0x14005ab07
lea rcx, [0x14031d280]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FlsAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c4ad8], rax
mov qword [0x1404c4ae0], 0
lea rcx, [0x14031d280]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FlsFree
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c4ae8], rax
lea rcx, [0x14031d280]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FlsGetValue
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c4af0], rax
lea rcx, [0x14031d280]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FlsSetValue
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404c4af8], rax
mov rdx, qword [0x1404c4ad8]
test rdx, rdx
je 0x14005ac14
cmp qword [0x1404c4ae8], 0
je 0x14005ac14
cmp qword [0x1404c4af0], 0
je 0x14005ac14
test rax, rax
je 0x14005ac14
lea rcx, [0x14005a970]
call rdx
jmp 0x14005ab13
mov qword [0x1404c4ad8], 0
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov qword [0x1404c4ae0], rax
mov rax, qword [sym.imp.KERNEL32.dll_TlsFree]
mov qword [0x1404c4ae8], rax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [0x1404c4af0], rax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1404c4af8], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x14005ab13
Function at 0x14005cf80
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.14005e920
test eax, eax
je 0x14005cfc9
movzx edx, word [rsp + 0x78]
test dx, dx
je 0x14005cfc9
mov rcx, rbx
call fcn.14005d060
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x28]
cmp ecx, 9
ja 0x14005d012
je 0x14005d009
test ecx, ecx
je 0x14005d000
sub ecx, 5
je 0x14005cff7
cmp ecx, 1
jne 0x14005d017
lea rdx, str.Itanium
jmp 0x14005d049
lea rdx, [0x14033f2e8]
jmp 0x14005d049
lea rdx, [0x14033f2b4]
jmp 0x14005d049
lea rdx, [0x14033f2b8]
jmp 0x14005d049
cmp ecx, 0xc
je 0x14005d042
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rdx, str.ARM64
mov rcx, rbx
call fcn.140010ee0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x14005d140
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rbx, rcx
jb 0x14005d15f
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14005d180
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rdi, rdi
je 0x14005d1bc
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14005c7d0
cmp qword [rbx + 0x18], 8
jb 0x14005d19f
mov rbx, qword [rbx]
mov rdx, qword [rax + 8]
mov r8d, esi
mov rcx, rbx
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call fcn.1400429e0
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14005d840
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x68]
call fcn.140010ee0
nop
mov qword [rsp + 0x28], rbp
lea r8d, [rbp + 2]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.14008caf0
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x68]
call fcn.1400119a0
lea rdx, str.IsWow64Process2
lea rcx, [rsp + 0x38]
call fcn.140010ee0
nop
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call fcn.14008cf60
mov rdi, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x38]
call fcn.1400119a0
test rdi, rdi
je 0x14005d934
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call rdi
mov edi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14005d91e
call fcn.14008dc60
nop
test edi, edi
je 0x14005d944
movzx edx, word [rsp + 0x20]
mov rcx, rbx
call fcn.14005d060
jmp 0x14005d9e4
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14005d944
call fcn.14008dc60
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor r8d, r8d
lea rdx, [rsp + 0x24]
call fcn.14005e920
test eax, eax
je 0x14005d968
movzx edx, word [rsp + 0x24]
test dx, dx
jne 0x14005d927
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x38]
cmp ecx, 9
ja 0x14005d9b1
je 0x14005d9a8
test ecx, ecx
je 0x14005d99f
sub ecx, 5
je 0x14005d996
cmp ecx, 1
jne 0x14005d9b6
lea rdx, str.Itanium
jmp 0x14005d9dc
lea rdx, [0x14033f2e8]
jmp 0x14005d9dc
lea rdx, [0x14033f2b4]
jmp 0x14005d9dc
lea rdx, [0x14033f2b8]
jmp 0x14005d9dc
cmp ecx, 0xc
je 0x14005d9d5
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
jmp 0x14005d9e4
lea rdx, str.ARM64
mov rcx, rbx
call fcn.140010ee0
mov rax, rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14003b100
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005e410
Capabilities:
Get session user name
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov rdi, rcx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x14005e455
mov r8d, ebx
lea rcx, str.username
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14006c810
Capabilities:
Check if file exists

Disassembly:
mov edx, 1
jmp fcn.140071a30
Function at 0x140071a30
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edi, edx
movzx esi, dl
and sil, 1
shr edi, 1
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14003d6e0
nop
and dil, 1
je 0x140071ae1
lea rcx, [rsp + 0x20]
call fcn.140097280
test al, al
je 0x140071ae1
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
cmp rbx, 1
je 0x140071ae1
cmp rbx, 3
jne 0x140071ab1
lea rax, [rsp + 0x20]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x38]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + 2], 0x3a
je 0x140071aeb
jmp 0x140071ac5
cmp rbx, 0x31
jne 0x140071ac5
lea rcx, [rsp + 0x20]
call fcn.14006f030
test al, al
jne 0x140071ae1
lea rdx, [rbx - 1]
lea rcx, [rsp + 0x20]
call fcn.1400464b0
lea rcx, [rsp + 0x20]
call fcn.140097280
test al, al
jne 0x140071a80
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
cmp r8, 8
cmovae rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140071b08
xor dil, dil
jmp 0x140071b10
test al, 0x10
jne 0x140071b10
movzx edi, sil
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x20]
call fcn.1400119a0
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003b100
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140072a20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x58], edi
mov rax, qword [0x1404c4808]
test rax, rax
jne 0x140072a51
call fcn.14004c0f0
mov qword [0x1404c4808], rax
mov rdx, rax
mov rcx, rsi
call fcn.1400437b0
test rax, rax
jne 0x140072aab
call fcn.140044e20
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 4
mov ecx, Ordinal_27
call fcn.14003b21c
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rax, [0x1403102d9]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov word [rbx + 0x10], 1
mov byte [rbx + 0x12], 0
mov rbp, rbx
mov r14, rbx
mov r15, rbx
jmp 0x140072b3b
mov rdi, qword [rsi + 0x28]
mov rsi, qword [rsi + 0x20]
cmp rdi, 0xffffffffffffffff
jne 0x140072aec
test rsi, rsi
je 0x140072add
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140072ac0
call fcn.140044e20
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], reloc.COMCTL32.dll_CreateUpDownControl
jmp 0x140072b0f
call fcn.140044e20
mov dword [rsp + 0x58], reloc.COMCTL32.dll_CreateUpDownControl
jmp 0x140072b2f
call fcn.140044e20
mov rbx, rax
mov rbp, rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], reloc.COMCTL32.dll_CreateUpDownControl
mov r14, rax
mov r15, rax
test rsi, rsi
je 0x140072b3b
mov ecx, Ordinal_27
call fcn.14003b21c
mov qword [rsp + 0x58], rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov word [rax + 0x10], 1
mov byte [rax + 0x12], 0
mov r15, rax
mov r14, rax
mov rbp, rax
mov rbx, rax
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
call fcn.140044e20
cmp rbp, rax
je 0x140072b80
mov eax, 0xffff
add word [r14 + 0x10], ax
jne 0x140072b7a
cmp byte [r15 + 0x12], 0
je 0x140072b6d
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14003b258
call fcn.140044e20
nop
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140072e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], 7
mov word [rdx], r15w
mov qword [rdx + 0x20], r15
mov qword [rdx + 0x28], r15
mov dword [rsp + 0x30], 1
lea r12, [0x1403410d0]
mov eax, dword [rsi + 0x10]
test eax, eax
jne 0x140072eb4
mov rcx, rsi
call fcn.140072c90
movzx ecx, al
mov eax, ecx
xor eax, 1
inc eax
mov dword [rsi + 0x10], eax
jmp 0x140072eba
cmp eax, 1
sete cl
test cl, cl
je 0x140072fd5
mov dword [rsi + 0x10], r15d
mov rdi, qword [rsi + 0x58]
mov rax, qword [rsi + 0x50]
mov rbp, qword [rax]
mov rax, qword [rsi + 0x60]
cmp qword [rsi + 0x48], rax
jae 0x140072f1a
cmp qword [0x1404b3060], 0
je 0x140072f1a
mov qword [rsp + 0x20], r12
lea r9, str.from___end
lea r8, str.find_first_of
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea rcx, str.C:LibrarieswxWidgets3.2.4_srccommon_tokenzr.cpp
call fcn.140042050
cmp byte [0x1404c47a8], 0
je 0x140072f1a
mov byte [0x1404c47a8], 0
int3
mov rbx, qword [rsi + 0x60]
mov r8, qword [rsi + 0x48]
cmp rbx, r8
je 0x140072f64
nop word [rax + rax]
movzx eax, word [rbx]
mov rdx, rdi
mov rcx, rbp
test rdi, rdi
je 0x140072f4f
nop
cmp word [rcx], ax
je 0x140072f4f
add rcx, 2
sub rdx, 1
jne 0x140072f40
test rdx, rdx
cmove rcx, r15
test rcx, rcx
jne 0x140072f67
add rbx, 2
cmp rbx, r8
jne 0x140072f30
mov rbx, r8
cmp rbx, r8
jne 0x140072f8c
mov rdx, qword [rsi + 0x60]
sub r8, rdx
sar r8, 1
mov rcx, r14
call fcn.140038360
mov rax, qword [rsi + 0x48]
mov qword [rsi + 0x60], rax
movzx eax, r15w
jmp 0x140072fc0
mov r8, rbx
lea rdi, [rbx + 2]
cmp dword [rsi + 0x68], 3
jne 0x140072f9c
mov r8, rdi
mov rdx, qword [rsi + 0x60]
sub r8, rdx
sar r8, 1
mov rcx, r14
call fcn.140038360
mov qword [rsi + 0x60], rdi
cmp rbx, qword [rsi + 0x48]
jne 0x140072fbd
mov eax, r15d
jmp 0x140072fc0
movzx eax, word [rbx]
mov word [rsi + 0x6c], ax
cmp dword [rsi + 0x68], 4
jne 0x140072fd5
cmp qword [r14 + 0x10], 0
je 0x140072e96
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140075830
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
cmp byte [rcx + 0xb8], 0
mov rsi, rcx
jne 0x140075892
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov byte [rcx + 0xb8], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsi + 0xa8]
lea r9, [rsi + 0x10]
mov rcx, rax
lea r8, [rsi + 0xb0]
call fcn.1400beee0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x140075892
lea rcx, str.SymFromAddr
add rsp, 0x20
pop rsi
jmp fcn.1400c0d70
add rsp, 0x20
pop rsi
ret
Function at 0x14008c7a0
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x1404c4d58]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x1404c4d60], rax
add rsp, 0x28
ret

Function at 0x140092490
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0xd0
call fcn.1400c8da0
lea rcx, [rbx + 0x170]
call fcn.1400c8da0
lea rcx, [rbx + 0x80]
call fcn.1400cbb10
test al, al
je 0x1400924d8
lea rcx, [rbx + 0x120]
cmp qword [rcx], 0
je 0x1400924d8
add rsp, 0x20
pop rbx
jmp fcn.1400cbb10
add rsp, 0x20
pop rbx
ret
Function at 0x140093c80
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15d, edx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rsp + 0x30], 1
mov r8d, 0x104
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14005c7d0
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebp, eax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
lea rdi, [0x140310350]
mov rcx, rdi
test rdx, rdx
cmovne rcx, rdx
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rcx + r8*2], 0
jne 0x140093d21
mov rdx, rcx
mov rcx, qword [rsp + 0x38]
call fcn.140038360
nop
call fcn.140044e20
mov r12d, 0xffff
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x140093d82
add word [rcx + 0x10], r12w
jne 0x140093d7c
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x140093d7c
cmp byte [rsi + 0x12], 0
je 0x140093d6f
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rsi
call fcn.14003b258
call fcn.140044e20
nop
cmp ebp, 0x80004005
jne 0x140093e2e
mov r8d, 0x104
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14005c7d0
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
nop
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
cmovne rdi, rcx
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140093dd1
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call fcn.140038360
nop
call fcn.140044e20
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x140093e2e
add word [rcx + 0x10], r12w
jne 0x140093e28
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140093e28
cmp byte [rbx + 0x12], 0
je 0x140093e1b
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, Ordinal_27
mov rcx, rbx
call fcn.14003b258
call fcn.140044e20
nop
mov rax, r14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400969e0
Capabilities:
Check if file exists

Disassembly:
mov edx, 2
jmp fcn.140071a30
jmp 0x14006c730