joyce8/EMBER2024-capa huggingface dataset:
Function at 0x190ebd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
sub rsp, 0x98
cmp dword [rcx + 0x247d0], 0
movaps xmmword [rax - 0x38], xmm6
movss xmm6, dword [rcx + 0x246a4]
movaps xmmword [rax - 0x48], xmm7
movss xmm7, dword [rcx + 0x24690]
mov rsi, r8
mov rdi, rdx
je 0x190edf2
test r9d, r9d
je 0x190ee56
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
movaps xmmword [rax - 0x58], xmm8
movss xmm8, dword [0x01892040]
lea rax, [rcx + 0x24958]
lea ebp, [r9 - 1]
lea r12, [rcx + 0x247d8]
mov qword [rsp + 0x30], rax
lea rax, [rcx + 0x24a18]
shr ebp, 1
mov qword [rsp + 0x38], rax
lea rax, [rcx + 0x249b8]
lea r13, [rcx + 0x24898]
mov qword [rsp + 0x40], rax
lea rax, [rcx + 0x24a78]
lea r14, [rcx + 0x24838]
lea r15, [rcx + 0x248f8]
inc ebp
mov qword [rsp + 0x48], rax
nop word [rax + rax]
lea r8, [rsp + 0x24]
mov r9d, 1
mov rdx, rdi
mov rcx, r12
call fcn.0194e5b0
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x24]
mov r9d, 1
mov rcx, r13
call fcn.0194e5b0
lea r8, [rsp + 0x28]
lea rdx, [rdi + 4]
mov r9d, 1
mov rcx, r14
call fcn.0194e5b0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x28]
mov r9d, 1
mov rcx, r15
call fcn.0194e5b0
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x20]
mov r9d, 1
mov rdx, rdi
call fcn.0194e5b0
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov r9d, 1
call fcn.0194e5b0
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0xb0]
lea rdx, [rdi + 4]
mov r9d, 1
call fcn.0194e5b0
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb0]
mov r9d, 1
call fcn.0194e5b0
add rsi, 8
add rdi, 8
dec rbp
movss xmm5, dword [rsp + 0xb0]
movss xmm1, dword [rsp + 0x20]
movaps xmm0, xmm5
xorps xmm5, xmm8
mulss xmm0, xmm7
addss xmm0, xmm1
mulss xmm1, xmm7
addss xmm0, dword [rsp + 0x24]
subss xmm5, xmm1
mulss xmm0, xmm6
addss xmm5, dword [rsp + 0x28]
addss xmm0, dword [rsi - 8]
mulss xmm5, xmm6
addss xmm5, dword [rsi - 4]
movss dword [rsi - 8], xmm0
movss dword [rsi - 4], xmm5
jne 0x190ec90
movaps xmm8, xmmword [rsp + 0x50]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
jmp 0x190ee56
test r9d, r9d
je 0x190ee56
movss xmm3, dword [0x01892040]
lea edx, [r9 - 1]
sub rdi, r8
shr edx, 1
lea rcx, [r8 + 4]
inc edx
nop
movss xmm2, dword [rdi + rcx]
movss xmm1, dword [rdi + rcx - 4]
add rcx, 8
dec rdx
movaps xmm0, xmm2
xorps xmm2, xmm3
mulss xmm0, xmm7
addss xmm0, xmm1
mulss xmm1, xmm7
subss xmm2, xmm1
mulss xmm0, xmm6
addss xmm0, dword [rcx - 0xc]
mulss xmm2, xmm6
addss xmm2, dword [rcx - 8]
movss dword [rcx - 0xc], xmm0
movss dword [rcx - 8], xmm2
jne 0x190ee10
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x1917a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
xor ebx, ebx
mov r9, rdx
mov rsi, rcx
test r8d, r8d
je 0x1917b30
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop
movzx r11d, word [r9]
shr r11d, 4
and r11d, 0xf
xor r10d, r10d
movsxd rax, r11d
lea r8, [rsi + rax*8 + 4]
cmp r11d, 0xa
jae 0x1917b11
movzx edx, word [r9]
mov ecx, r10d
mov eax, 0x100
shl eax, cl
test edx, eax
je 0x1917b11
movzx eax, byte [r8 - 4]
xor al, dl
test al, 0xf
jne 0x1917afd
movzx eax, word [r8 - 2]
cmp word [r9 + 2], ax
jne 0x1917afd
movzx eax, word [r8]
cmp word [r9 + 4], ax
jne 0x1917afd
movzx eax, word [r8 + 2]
cmp word [r9 + 6], ax
je 0x1917b11
mov rax, qword [r9]
lea ecx, [r10 + r11*2]
mov edx, 1
shl edx, cl
mov qword [r8 - 4], rax
or ebx, edx
inc r10d
add r8, 0x50
cmp r10d, 2
jb 0x1917ab7
add r9, 8
dec rdi
jne 0x1917aa0
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
pop rsi
ret
Function at 0x1919be0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
mov qword [rsp + 0x58], rbx
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x20], rbp
mov rbx, rdx
rdtsc
mov rcx, qword [rcx + 0x21948]
stmxcsr dword [rsp + 0x50]
shl rdx, 0x20
mov r12d, dword [rsp + 0x50]
or rax, rdx
lea r8d, [r9*4]
mov r10d, r12d
mov rdx, rbx
mov r13, rax
or r10d, 0x8940
mov dword [rsp + 0x50], r10d
ldmxcsr dword [rsp + 0x50]
call fcn.018f2fe8
mov rcx, qword [rdi + 0x21958]
lea rdx, [rsp + 0x68]
mov r8d, 4
call fcn.018f2fe8
cmp dword [rdi + 0x284], 0
je 0x1919c75
mov rcx, rdi
mov dword [rdi + 0x284], 0
call fcn.019197f0
movsxd rbp, dword [rsp + 0x68]
cmp rsi, rbx
je 0x1919c91
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
shl r8, 2
call sub.msvcrt.dll_memcpy
mov r8d, ebp
mov rdx, rsi
mov rcx, rdi
call fcn.019198a0
cmp dword [rdi + 0x1d408], 0
je 0x1919cc5
mov edx, dword [rdi + 4]
lea r8, [rdi + 0x54]
lea rcx, [rdi + 0x1d400]
mov r9d, 0x6400
call fcn.019189b0
mov ebp, dword [rsp + 0x68]
lea rcx, [rdi + 0x1d400]
mov r8d, ebp
mov rdx, rsi
call fcn.01917630
mov r9d, dword [rsp + 0x68]
lea rcx, [rdi + 0x2d0]
mov r8, rsi
mov rdx, rsi
call fcn.01932d80
mov r8d, dword [rsp + 0x68]
lea rcx, [rdi + 0x1d400]
mov rdx, rsi
call fcn.01917700
mov r9d, dword [rsp + 0x68]
lea rcx, [rdi + 0x1dc08]
mov r8, rsi
mov rdx, rsi
call fcn.0192ec90
mov r8d, dword [rsp + 0x68]
lea rcx, [rdi + 0x217d0]
mov rdx, rsi
call fcn.0192e3b0
mov r8d, dword [rsp + 0x68]
mov rcx, qword [rdi + 0x21950]
shl r8d, 2
mov rdx, rsi
call fcn.018f2fe8
cmp dword [rdi + 0x10], 0
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x58]
je 0x1919d9d
mov eax, dword [rsp + 0x68]
test eax, eax
jle 0x1919d9d
movss xmm1, dword [0x01892210]
movss xmm2, dword [0x01849730]
nop dword [rax]
movss xmm0, dword [rsi]
comiss xmm0, xmm1
jbe 0x1919d85
mov dword [rdi + 0x21910], 0x8007
jmp 0x1919d94
comiss xmm0, xmm2
jae 0x1919d94
mov dword [rdi + 0x21910], 0xffff7ff8
add rsi, 4
dec rax
jne 0x1919d70
inc dword [rdi + 0x21914]
stmxcsr dword [rsp + 0x50]
and r12d, 0x8940
mov eax, dword [rsp + 0x50]
and eax, 0xffff76bf
or eax, r12d
mov dword [rsp + 0x68], eax
ldmxcsr dword [rsp + 0x68]
rdtsc
shl rdx, 0x20
or rax, rdx
sub eax, r13d
mov dword [rdi + 0x21918], eax
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x192b110
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
xor r9d, r9d
test r8d, r8d
je 0x192b228
movss xmm4, dword [rcx + 8]
mov r10d, dword [rcx + 0xc]
movss xmm5, dword [rcx + 0x1c]
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm8
movss xmm8, dword [rcx + 4]
movss xmm6, dword [rcx + 0x18]
movss xmm7, dword [rcx + 0x14]
movaps xmmword [rsp + 0x20], xmm9
movaps xmmword [rsp + 0x10], xmm10
movaps xmmword [rsp], xmm11
movss xmm11, dword [rcx + 0x10]
movss xmm9, dword [rcx]
movss xmm10, dword [0x01892040]
movss xmm3, dword [rdx + r9*4]
movaps xmm2, xmm9
add r9d, r10d
mulss xmm2, xmm11
movaps xmm0, xmm3
movaps xmm1, xmm3
mulss xmm1, xmm3
subss xmm0, xmm5
mulss xmm0, xmm4
subss xmm1, xmm6
addss xmm5, xmm0
mulss xmm1, xmm4
movaps xmm0, xmm8
mulss xmm0, xmm7
addss xmm6, xmm1
movss dword [rcx + 0x1c], xmm5
movaps xmm1, xmm9
mulss xmm1, xmm7
subss xmm2, xmm0
movss dword [rcx + 0x18], xmm6
movaps xmm0, xmm8
mulss xmm0, xmm11
addss xmm1, xmm0
subss xmm3, xmm2
movaps xmm0, xmm1
mulss xmm3, xmm4
movaps xmm7, xmm1
addss xmm2, xmm3
xorps xmm0, xmm10
mulss xmm0, xmm4
movss dword [rcx + 0x10], xmm2
movaps xmm11, xmm2
addss xmm7, xmm0
movss dword [rcx + 0x14], xmm7
cmp r9d, r8d
jb 0x192b173
movaps xmm11, xmmword [rsp]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x1936460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, qword [rcx]
xor ebp, ebp
mov r12, rdx
mov rbx, r8
mov rdx, rcx
mov r9, r12
mov r10d, ebp
cmp dword [rdi + 0x30], ebp
jle 0x19364ed
lea rax, [r8 + 4]
nop word [rax + rax]
movss xmm1, dword [rax + 0x14]
movss xmm0, dword [rax + 0x18]
inc r10d
add r9, 8
add rax, 0x20
mulss xmm0, dword [rax - 0x20]
mulss xmm1, dword [rax - 0x24]
subss xmm1, xmm0
movss dword [r9 - 8], xmm1
movss xmm2, dword [rax - 0xc]
movss xmm0, dword [rax - 8]
mulss xmm2, dword [rax - 0x20]
mulss xmm0, dword [rax - 0x24]
addss xmm2, xmm0
movss dword [r9 - 4], xmm2
cmp r10d, dword [rdi + 0x30]
jl 0x19364a0
movsxd rcx, dword [rdi + 0x4c]
mov rax, qword [rdx + 0x20]
mov rdx, r12
lea rsi, [rax + rcx*8]
mov rcx, rdi
mov r8, rsi
call fcn.019360e0
mov ecx, ebp
mov r11, r12
cmp dword [rdi + 0x30], ecx
jle 0x193656a
lea rax, [rbx + 0xc]
nop word [rax + rax]
movss xmm1, dword [rax + 0xc]
movss xmm0, dword [rax]
inc ecx
add r11, 8
add rax, 0x20
mulss xmm0, dword [rax - 0x10]
mulss xmm1, dword [rax - 0x24]
subss xmm1, xmm0
movss dword [r11 - 8], xmm1
movss xmm2, dword [rax - 0x20]
movss xmm0, dword [rax - 0x10]
mulss xmm2, dword [rax - 0x14]
mulss xmm0, dword [rax - 0x24]
addss xmm2, xmm0
movss dword [r11 - 4], xmm2
cmp ecx, dword [rdi + 0x30]
jl 0x1936520
movsxd rax, dword [rdi + 0x30]
mov rdx, r12
mov rcx, rdi
lea r13, [rsi + rax*8]
mov r8, r13
call fcn.019360e0
mov rsi, r12
cmp dword [rdi + 0x30], ebp
jle 0x193667b
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movss xmm7, dword [0x01849658]
add rbx, 0x10
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x20], xmm9
movss xmm9, dword [0x0189202c]
xorps xmm8, xmm8
nop dword [rax + rax]
movss xmm1, dword [rbx + 0xc]
movss xmm0, dword [rbx + 8]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.01954440
movss xmm1, dword [rbx + 4]
mulss xmm1, xmm1
movaps xmm6, xmm0
movss xmm0, dword [rbx]
mulss xmm0, xmm0
addss xmm0, xmm1
call fcn.01954440
mulss xmm6, xmm9
comiss xmm0, xmm6
ja 0x193660e
comiss xmm0, xmm8
jbe 0x193660e
divss xmm6, xmm0
jmp 0x1936611
movaps xmm6, xmm7
movss xmm1, dword [rbx]
movss xmm0, dword [rbx - 0xc]
inc ebp
add rsi, 8
add rbx, 0x20
mulss xmm0, dword [rbx - 0x1c]
mulss xmm1, dword [rbx - 0x30]
subss xmm1, xmm0
mulss xmm1, xmm6
movss dword [rsi - 8], xmm1
movss xmm2, dword [rbx - 0x20]
movss xmm0, dword [rbx - 0x1c]
mulss xmm2, dword [rbx - 0x2c]
mulss xmm0, dword [rbx - 0x30]
addss xmm2, xmm0
mulss xmm2, xmm6
movss dword [rsi - 4], xmm2
cmp ebp, dword [rdi + 0x30]
jl 0x19365c0
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
movsxd rax, dword [rdi + 0x30]
mov rdx, r12
mov rcx, rdi
lea r8, [r13 + rax*8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.019360e0
Function at 0x1957a78
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8d, dword [rdx + 8]
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x018e7030]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, dword [rbx + 0xc]
lea rdx, [0x018e7058]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, dword [rbx + 0x10]
lea rdx, [0x018e7098]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r8d, dword [rbx + 0x14]
lea rdx, [0x018e70b8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rbx], 0x18
je 0x1957b5f
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x1957b5f
bt dword [rcx + 0x1c], 0xc
jae 0x1957b5f
cmp byte [rcx + 0x19], 2
jb 0x1957b5f
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4350]
mov dx, 0x23
call fcn.018ebef8
mov eax, dword [rbx + 0xc]
mov rcx, qword [rdi + 0x80]
mov esi, 4
lea edx, [rsi - 1]
lea r8, [rsp + 0x20]
mov r9d, esi
mov dword [rsp + 0x20], eax
call fcn.01910230
mov r11d, dword [rbx + 8]
mov rcx, qword [rdi + 0x80]
lea r8, [rsp + 0x20]
lea edx, [rsi - 2]
mov r9d, esi
mov dword [rsp + 0x20], r11d
call fcn.01910230
mov r11d, dword [rbx + 0x10]
mov rcx, qword [rdi + 0x80]
lea r8, [rsp + 0x20]
mov r9d, esi
mov edx, esi
mov dword [rsp + 0x20], r11d
call fcn.01910230
mov rcx, qword [rdi + 0x80]
lea r8, [rdi + 0xe0]
lea edx, [rsi + 1]
mov r9d, esi
call fcn.01910230
mov rcx, qword [rdi + 0x80]
lea r8, [rdi + 0xdc]
lea edx, [rsi + 2]
mov r9d, esi
call fcn.01910230
mov rcx, qword [rdi + 0x80]
lea r8, [rdi + 0xd8]
lea edx, [rsi + 4]
mov r9d, esi
call fcn.01910230
lea rcx, [rdi + 0xc0]
lea r8d, [rsi + 0x14]
mov rdx, rbx
call sub.msvcrt.dll_memcpy
mov r11d, dword [rbx + 0x14]
xor eax, eax
mov dword [rdi + 0x68], r11d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x195b680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x470
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov dword [rsp + 0x28], r8d
mov r12, rcx
mov r13d, r8d
mov r14d, edx
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x50]
lea r9, [0x018e7190]
mov edx, 0x402
mov r8d, 0x201
call sub.msvcrt.dll__snwprintf_s
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ebx, ebx
cmp eax, ebx
mov esi, eax
jne 0x195b7d4
mov rax, qword [r12 + 0x1d98]
cmp rax, rbx
je 0x195b7d4
lea rcx, [rsp + 0x40]
lea rdx, [0x018e7a30]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x40], 0x350
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov rcx, qword [0x01965a38]
lea rdi, [0x01965a38]
mov esi, eax
jne 0x195b7a6
mov rbp, rbx
cmp rcx, rdi
je 0x195b795
bt dword [rcx + 0x1c], 0x1b
jae 0x195b795
cmp byte [rcx + 0x19], 4
jb 0x195b795
mov rax, qword [r12 + 0x1d98]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x30], r13d
mov eax, dword [rax + rbp]
lea r8, [0x018e4320]
mov r9d, ebx
mov dx, 0x79
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.018fc6a8
mov rcx, qword [0x01965a38]
add ebx, 1
add rbp, 4
cmp ebx, 0xd3
jl 0x195b74c
jmp 0x195b7d4
cmp rcx, rdi
je 0x195b7d4
bt dword [rcx + 0x1c], 0x1b
jae 0x195b7d4
cmp byte [rcx + 0x19], 4
jb 0x195b7d4
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, eax
mov dx, 0x7a
mov dword [rsp + 0x20], r13d
call fcn.018fc70c
mov eax, esi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.018fdad0
add rsp, 0x470
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003270
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3b0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x90]
call fcn.140003760
nop
mov rdx, qword [rsp + 0x3c8]
lea rcx, [rsp + 0x110]
call fcn.1400030b0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x3d0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.140003970
nop
lea rcx, [rsp + 0x110]
call fcn.1400023b0
lea rcx, [rsp + 0xb0]
call fcn.1400048d0
movzx eax, al
test eax, eax
je 0x1400034ee
lea rax, [rsp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0xb0]
call fcn.140002380
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x3e0]
call fcn.140002380
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x3d8]
call fcn.140002380
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x190]
lea r8, [0x140019ad8]
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x190]
test eax, eax
je 0x1400034ee
lea rdx, str.Application
lea rcx, [rsp + 0xd0]
call fcn.140003720
nop
mov rdx, qword [rsp + 0x3c8]
lea rcx, [rsp + 0x150]
call fcn.1400030b0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x130]
call fcn.140004290
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.140003690
nop
lea rcx, [rsp + 0x130]
call fcn.1400023b0
nop
lea rcx, [rsp + 0x150]
call fcn.1400023b0
nop
lea rcx, [rsp + 0xd0]
call fcn.1400023b0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xf0]
call fcn.140003720
nop
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x170]
call fcn.140004290
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.140003690
nop
lea rcx, [rsp + 0x170]
call fcn.1400023b0
nop
lea rcx, [rsp + 0xf0]
call fcn.1400023b0
lea rcx, [rsp + 0x90]
call fcn.140004a20
movzx eax, al
test eax, eax
je 0x1400034ee
mov edx, 0x10
lea rcx, [rsp + 0x90]
call fcn.140003fa0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x3c0]
call fcn.1400036f0
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xb0]
call fcn.1400023b0
nop
lea rcx, [rsp + 0x90]
call fcn.1400023b0
nop
mov rcx, qword [rsp + 0x3c8]
call fcn.1400023b0
nop
mov rcx, qword [rsp + 0x3d0]
call fcn.1400023b0
nop
mov rcx, qword [rsp + 0x3d8]
call fcn.1400023b0
nop
mov rcx, qword [rsp + 0x3e0]
call fcn.1400023b0
mov rax, qword [rsp + 0x3c0]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.140014e60
add rsp, 0x3b0
pop rdi
ret
Function at 0x140007050
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.140014e84
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x1400070b7
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140014e60
add rsp, 0x150
pop rbx
ret
Function at 0x140009d50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140009d8f
mov rax, qword [rdx]
mov word [rax], si
call fcn.140009e60
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x140009daf
test dil, dil
jne 0x140009e29
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140009dc5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140009e00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003780
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140014e60
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rdx, rcx
jmp 0x140009d50

Function at 0x14000a100
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140009d8f
mov rax, qword [rdx]
mov word [rax], si
call fcn.140009e60
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x140009daf
test dil, dil
jne 0x140009e29
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140009dc5
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x207
lea rdx, [rsp + 0x30]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140009e00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140003780
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140014e60
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rdx, rcx
jmp 0x140009d50
Function at 0x14000a2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000a315
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000a3c6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14001adf0]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14000a3f0
test al, al
je 0x14000a36e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000a3b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a3ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a3ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140014ec0
movdqa xmm0, xmmword [0x14001adf0]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014e60
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14000a6b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000a737
cmp dword [rsp + 0x44], 6
jb 0x14000a737
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.14000a4f0
test al, al
je 0x14000a737
cmp word [rbx], 0
jne 0x14000a7a1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.14000a4f0
test al, al
je 0x14000a76c
cmp word [rbx], 0
jne 0x14000a7a1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.14000a4f0
test al, al
je 0x14000a7a5
cmp word [rbx], 0
je 0x14000a7a5
mov al, 1
jmp 0x14000a7a7
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140014e60
add rsp, 0x170
pop rbx
ret