joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x20], xmm3
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov byte [rsp + 0x21], 0
mov dword [rsp + 0x3c], 0x10f8
mov byte [rsp + 0x22], 1
lea rdx, [0x140106f28]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
mov byte [rsp + 0x23], 1
xor eax, eax
test eax, eax
je 0x14007c64d
mov dword [rsp + 0x24], 0x27
jmp 0x14007c642
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14007c64d
jmp 0x14007c638
lea rdx, [0x140107018]
lea rcx, [rsp + 0x68]
call fcn.1400b4670
mov qword [rsp + 0x40], rax
lea rdx, str.jbsrbfeszvgibtaol
lea rcx, [rsp + 0x48]
call fcn.1400b4670
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
mov rcx, rax
call fcn.1400b17c0
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x48]
call fcn.1400b5930
lea rcx, [rsp + 0x68]
call fcn.1400b5930
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14007c6c4
mov dword [rsp + 0x28], 0x22
jmp 0x14007c6b9
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14007c6c4
jmp 0x14007c6af
xor eax, eax
test eax, eax
je 0x14007c6e9
mov dword [rsp + 0x2c], 7
jmp 0x14007c6de
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14007c6e9
jmp 0x14007c6d4
xor eax, eax
cmp eax, 1
je 0x14007c70f
mov dword [rsp + 0x30], 0x62
jmp 0x14007c704
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14007c70f
jmp 0x14007c6fa
xor eax, eax
test eax, eax
je 0x14007c734
mov dword [rsp + 0x34], 0x3b
jmp 0x14007c729
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x14007c734
jmp 0x14007c71f
mov dword [rsp + 0x38], 0x77f1
lea rcx, [rsp + 0x88]
call fcn.1400b5930
mov rcx, qword [rsp + 0xe0]
call fcn.1400b5930
mov rcx, qword [rsp + 0x100]
call fcn.1400b5930
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0xb8
ret
Function at 0x14007ff20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x20], xmm3
movsd qword [rsp + 0x18], xmm2
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov byte [rsp + 0x20], 1
mov byte [rsp + 0x21], 0
movsd xmm0, qword [0x14013b2e8]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], 0x102a
mov dword [rsp + 0x3c], 0x1760
lea rdx, str.imkmerkifzcevqpzqksmbsbhvslbv
lea rcx, [rsp + 0x68]
call fcn.1400b4670
lea rdx, str.psrwngztslilyeelylemfmhetgwaqcqtidrngqntljdievjattabrxgoovfzgs
lea rcx, [rsp + 0x48]
call fcn.1400b4670
xor eax, eax
cmp eax, 1
je 0x14007ffbe
mov dword [rsp + 0x24], 6
jmp 0x14007ffb3
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14007ffbe
jmp 0x14007ffa9
xor eax, eax
test eax, eax
je 0x14007ffe3
mov dword [rsp + 0x28], 0x4e
jmp 0x14007ffd8
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14007ffe3
jmp 0x14007ffce
xor eax, eax
cmp eax, 1
je 0x140080009
mov dword [rsp + 0x2c], 0x2b
jmp 0x14007fffe
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x140080009
jmp 0x14007fff4
xor eax, eax
cmp eax, 1
je 0x14008002f
mov dword [rsp + 0x30], 0x1e
jmp 0x140080024
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14008002f
jmp 0x14008001a
mov dword [rsp + 0x34], 0x571f
lea rcx, [rsp + 0x48]
call fcn.1400b5930
lea rcx, [rsp + 0x68]
call fcn.1400b5930
mov rcx, qword [rsp + 0xc0]
call fcn.1400b5930
mov rcx, qword [rsp + 0xc8]
call fcn.1400b5930
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x98
ret
Function at 0x140080790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0x21], 1
movsd xmm0, qword [0x1401386e8]
movsd qword [rsp + 0x58], xmm0
mov dword [rsp + 0x38], 0xf6f
lea rdx, str.govmqswspzrnjjpzgidltveziujobzcitkgwyzojiyiuwxepvqy
lea rcx, [rsp + 0xc8]
call fcn.1400b4670
mov dword [rsp + 0x3c], 0x126
mov dword [rsp + 0x40], 0xf8e
mov dword [rsp + 0x44], 0x434
lea rdx, [0x14011cdd8]
lea rcx, [rsp + 0xa8]
call fcn.1400b4670
mov dword [rsp + 0x48], 0x10f
movsd xmm0, qword [0x140135d90]
movsd qword [rsp + 0x60], xmm0
xor eax, eax
test eax, eax
je 0x140080852
mov dword [rsp + 0x24], 0x1c
jmp 0x140080847
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x140080852
jmp 0x14008083d
xor eax, eax
test eax, eax
je 0x140080877
mov dword [rsp + 0x28], 0x13
jmp 0x14008086c
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x140080877
jmp 0x140080862
xor eax, eax
test eax, eax
je 0x14008089c
mov dword [rsp + 0x2c], 0x5a
jmp 0x140080891
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14008089c
jmp 0x140080887
lea rdx, [0x14011d7d8]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
mov qword [rsp + 0x50], rax
lea rdx, str.bupxclvxeqfspdfbpinwmwhqlhakybvspzxjgmn
lea rcx, [rsp + 0x68]
call fcn.1400b4670
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call fcn.1400b17c0
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.1400b5930
lea rcx, [rsp + 0x88]
call fcn.1400b5930
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140080919
mov dword [rsp + 0x30], 0x10
jmp 0x14008090e
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x140080919
jmp 0x140080904
mov dword [rsp + 0x34], 0x2b31
lea rcx, [rsp + 0xa8]
call fcn.1400b5930
lea rcx, [rsp + 0xc8]
call fcn.1400b5930
mov rcx, qword [rsp + 0x118]
call fcn.1400b5930
mov rcx, qword [rsp + 0x120]
call fcn.1400b5930
mov rcx, qword [rsp + 0x128]
call fcn.1400b5930
mov rcx, qword [rsp + 0x130]
call fcn.1400b5930
mov rcx, qword [rsp + 0x138]
call fcn.1400b5930
mov rcx, qword [rsp + 0x140]
call fcn.1400b5930
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0xf8
ret
Function at 0x140081980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x34], 0x20bb
mov dword [rsp + 0x38], 0x1519
movsd xmm0, qword [0x140135258]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x3c], 0x136e
mov byte [rsp + 0x20], 0
lea rdx, str.tlmdwqeeqtrkhgyycprblp
lea rcx, [rsp + 0x48]
call fcn.1400b4670
xor eax, eax
cmp eax, 1
je 0x140081a05
mov dword [rsp + 0x24], 0x13
jmp 0x1400819fa
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x140081a05
jmp 0x1400819f0
xor eax, eax
cmp eax, 1
je 0x140081a2b
mov dword [rsp + 0x28], 0x39
jmp 0x140081a20
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x140081a2b
jmp 0x140081a16
xor eax, eax
cmp eax, 1
je 0x140081a51
mov dword [rsp + 0x2c], 0x2f
jmp 0x140081a46
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x140081a51
jmp 0x140081a3c
xor eax, eax
test eax, eax
je 0x140081a76
mov dword [rsp + 0x30], 0x5d
jmp 0x140081a6b
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x140081a76
jmp 0x140081a61
lea rdx, str.ohczgberfjhoqgdryhkc
mov rcx, qword [rsp + 0x88]
call fcn.1400b4670
lea rcx, [rsp + 0x48]
call fcn.1400b5930
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x78
ret
Function at 0x14008fdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movsd xmm0, qword [0x140133ff8]
movsd qword [rsp + 0x40], xmm0
lea rdx, [0x1400e4fac]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
mov dword [rsp + 0x38], 0x1a38
mov byte [rsp + 0x20], 0
mov byte [rsp + 0x21], 1
mov dword [rsp + 0x3c], 0xb38
lea rdx, str.ddznomenrneongcxecpclpdhlgpcyfwblpzcfypelqrqpiayhiq
lea rcx, [rsp + 0x68]
call fcn.1400b4670
lea rdx, str.woltmtjsvztvxdlhmtwskoyoluouxsynkdppftkeiynrhhsce
lea rcx, [rsp + 0x48]
call fcn.1400b4670
mov byte [rsp + 0x22], 0
xor eax, eax
test eax, eax
je 0x14008fe64
mov dword [rsp + 0x24], 0x2b
jmp 0x14008fe59
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x14008fe64
jmp 0x14008fe4f
xor eax, eax
cmp eax, 1
je 0x14008fe8a
mov dword [rsp + 0x28], 0x52
jmp 0x14008fe7f
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x14008fe8a
jmp 0x14008fe75
xor eax, eax
cmp eax, 1
je 0x14008feb0
mov dword [rsp + 0x2c], 0x3a
jmp 0x14008fea5
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x14008feb0
jmp 0x14008fe9b
xor eax, eax
test eax, eax
je 0x14008fed5
mov dword [rsp + 0x30], 0x1c
jmp 0x14008feca
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14008fed5
jmp 0x14008fec0
xor eax, eax
cmp eax, 1
je 0x14008fefb
mov dword [rsp + 0x34], 0x62
jmp 0x14008fef0
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x14008fefb
jmp 0x14008fee6
lea rcx, [rsp + 0x48]
call fcn.1400b5930
lea rcx, [rsp + 0x68]
call fcn.1400b5930
lea rcx, [rsp + 0x88]
call fcn.1400b5930
mov rcx, qword [rsp + 0x100]
call fcn.1400b5930
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0xb8
ret
Function at 0x140092920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x20], xmm3
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rdx, [0x140115d60]
lea rcx, [rsp + 0xc8]
call fcn.1400b4670
mov byte [rsp + 0x21], 1
mov dword [rsp + 0x38], 0x2a0
mov byte [rsp + 0x22], 0
movsd xmm0, qword [0x1401364c0]
movsd qword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140133ca0]
movsd qword [rsp + 0x58], xmm0
lea rdx, str.dgymkwjpvnplmgyibhyfvebzxumiphcarygvdvmpfcihpdboigeqcxaztzreizwnswenzatljegq
lea rcx, [rsp + 0xa8]
call fcn.1400b4670
movsd xmm0, qword [0x14013b7e0]
movsd qword [rsp + 0x60], xmm0
mov dword [rsp + 0x3c], 0x14a3
mov byte [rsp + 0x23], 1
xor eax, eax
cmp eax, 1
je 0x1400929e4
mov dword [rsp + 0x24], 0x35
jmp 0x1400929d9
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x1400929e4
jmp 0x1400929cf
xor eax, eax
cmp eax, 1
je 0x140092a0a
mov dword [rsp + 0x28], 0x3d
jmp 0x1400929ff
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x140092a0a
jmp 0x1400929f5
lea rdx, [0x140115f90]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
mov qword [rsp + 0x40], rax
lea rdx, str.djxomdxtocgztkhdjfpcjdglkgbpfnduabvvmyvqjumgzrlpxrixbyuxvyrqjfywciwxyhssbpzskbcjq
lea rcx, [rsp + 0x68]
call fcn.1400b4670
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
mov rcx, rax
call fcn.1400b1760
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.1400b5930
lea rcx, [rsp + 0x88]
call fcn.1400b5930
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140092a87
mov dword [rsp + 0x2c], 0
jmp 0x140092a7c
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x140092a87
jmp 0x140092a72
xor eax, eax
test eax, eax
je 0x140092aac
mov dword [rsp + 0x30], 0x4e
jmp 0x140092aa1
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x140092aac
jmp 0x140092a97
xor eax, eax
cmp eax, 1
je 0x140092ad2
mov dword [rsp + 0x34], 0x4f
jmp 0x140092ac7
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x140092ad2
jmp 0x140092abd
movsd xmm0, qword [0x140137fb0]
movsd qword [rsp + 0x48], xmm0
lea rcx, [rsp + 0xa8]
call fcn.1400b5930
lea rcx, [rsp + 0xc8]
call fcn.1400b5930
movsd xmm0, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0xf8
ret
Function at 0x1400994b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsd qword [rsp + 0x18], xmm2
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x38], 0x1066
lea rdx, str.orfqizqawhfvswzevtcbiizfshlabvlktjinhpffuaavxoksmcuyiwschgu
lea rcx, [rsp + 0x128]
call fcn.1400b4670
movsd xmm0, qword [0x140137780]
movsd qword [rsp + 0x60], xmm0
mov dword [rsp + 0x3c], 0x21c
lea rdx, [0x1400ea5d4]
lea rcx, [rsp + 0x108]
call fcn.1400b4670
mov dword [rsp + 0x40], 0x227
lea rdx, [0x140130f18]
lea rcx, [rsp + 0xe8]
call fcn.1400b4670
mov dword [rsp + 0x44], 0x548
xor eax, eax
test eax, eax
je 0x140099567
mov dword [rsp + 0x24], 0x47
jmp 0x14009955c
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x140099567
jmp 0x140099552
lea rdx, [0x140130fd8]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
mov qword [rsp + 0x48], rax
lea rdx, [0x140131058]
lea rcx, [rsp + 0x68]
call fcn.1400b4670
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov rcx, rax
call fcn.1400b17c0
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x68]
call fcn.1400b5930
lea rcx, [rsp + 0x88]
call fcn.1400b5930
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400995e4
mov dword [rsp + 0x28], 0x5d
jmp 0x1400995d9
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x1400995e4
jmp 0x1400995cf
xor eax, eax
test eax, eax
je 0x140099609
mov dword [rsp + 0x2c], 0x40
jmp 0x1400995fe
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x140099609
jmp 0x1400995f4
xor eax, eax
cmp eax, 1
je 0x14009962f
mov dword [rsp + 0x30], 0x30
jmp 0x140099624
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x14009962f
jmp 0x14009961a
lea rdx, [0x1401310f8]
lea rcx, [rsp + 0xc8]
call fcn.1400b4670
mov qword [rsp + 0x50], rax
lea rdx, str.usmcnykrnoeoihuiqsokzrosoitencczc
lea rcx, [rsp + 0xa8]
call fcn.1400b4670
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov rcx, rax
call fcn.1400b1760
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0xa8]
call fcn.1400b5930
lea rcx, [rsp + 0xc8]
call fcn.1400b5930
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x1400996b2
mov dword [rsp + 0x34], 0x49
jmp 0x1400996a7
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x1400996b2
jmp 0x14009969d
movsd xmm0, qword [0x1401375c0]
movsd qword [rsp + 0x58], xmm0
lea rcx, [rsp + 0xe8]
call fcn.1400b5930
lea rcx, [rsp + 0x108]
call fcn.1400b5930
lea rcx, [rsp + 0x128]
call fcn.1400b5930
movsd xmm0, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x158
ret
Function at 0x1400a1900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov byte [rsp + 0x21], 1
mov dword [rsp + 0x38], 0xdf9
mov dword [rsp + 0x3c], 0x40b
lea rdx, [0x140101ee0]
lea rcx, [rsp + 0x88]
call fcn.1400b4670
xor eax, eax
cmp eax, 1
je 0x1400a197c
mov dword [rsp + 0x24], 0x50
jmp 0x1400a1971
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jle 0x1400a197c
jmp 0x1400a1967
xor eax, eax
test eax, eax
je 0x1400a19a1
mov dword [rsp + 0x28], 0x55
jmp 0x1400a1996
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jle 0x1400a19a1
jmp 0x1400a198c
lea rdx, [0x140101f20]
lea rcx, [rsp + 0x68]
call fcn.1400b4670
mov qword [rsp + 0x40], rax
lea rdx, str.aysbeetxgfnqvacpvednnyrmcfwywgwxtvrvvfjnoowcicujyckgkwkl
lea rcx, [rsp + 0x48]
call fcn.1400b4670
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
mov rcx, rax
call fcn.1400b17c0
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x48]
call fcn.1400b5930
lea rcx, [rsp + 0x68]
call fcn.1400b5930
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400a1a18
mov dword [rsp + 0x2c], 0x4b
jmp 0x1400a1a0d
mov eax, dword [rsp + 0x2c]
dec eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
jle 0x1400a1a18
jmp 0x1400a1a03
xor eax, eax
test eax, eax
je 0x1400a1a3d
mov dword [rsp + 0x30], 0xf
jmp 0x1400a1a32
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x1400a1a3d
jmp 0x1400a1a28
xor eax, eax
cmp eax, 1
je 0x1400a1a63
mov dword [rsp + 0x34], 0xe
jmp 0x1400a1a58
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x1400a1a63
jmp 0x1400a1a4e
lea rdx, str.wgjvo
mov rcx, qword [rsp + 0xc8]
call fcn.1400b4670
lea rcx, [rsp + 0x88]
call fcn.1400b5930
mov rcx, qword [rsp + 0xf0]
call fcn.1400b5930
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0xb8
ret

Function at 0x1400af3c0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400bd9e0
lea rcx, [rsp + 0x28]
call fcn.1400ba2f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400af405
mov byte [rsp + 0x20], 1
jmp 0x1400af40a
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x28]
call fcn.1400b5960
mov rcx, qword [rsp + 0x60]
call fcn.1400b5930
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x58
ret
Function at 0x1400af4a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.1400bd9e0
lea rcx, [rsp + 0x28]
call fcn.1400ba2f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x28]
call fcn.1400b5960
mov rcx, qword [rsp + 0x60]
call fcn.1400b5930
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x58
ret

Function at 0x1400af660
Capabilities:
Get common file path
Get program files directory

Disassembly:
push rdi
sub rsp, 0x5c0
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
xor r9d, r9d
mov r8d, 0x26
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1400af75f
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call fcn.1400b49e0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.1400af510
lea rcx, [rsp + 0x50]
call fcn.1400b5960
lea rdx, [rsp + 0x90]
lea rcx, [0x140155080]
call fcn.1400b5ea0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1400b6810
mov rcx, rax
call fcn.1400b6080
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400b4670
lea r8, [rsp + 0x70]
lea rdx, [0x140155080]
lea rcx, [rsp + 0x110]
call fcn.1400b18f0
mov rdx, rax
lea rcx, [0x140155040]
call fcn.1400b5e40
lea rcx, [rsp + 0x110]
call fcn.1400b5930
lea rcx, [rsp + 0x70]
call fcn.1400b5930
lea rcx, [rsp + 0x90]
call fcn.1400b5930
mov qword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14013ba38]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x1400af7d9
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xb0]
call fcn.1400b49e0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x130]
call fcn.1400af510
mov rdx, rax
lea rcx, [0x140154fe0]
call fcn.1400b5e40
lea rcx, [rsp + 0x130]
call fcn.1400b5930
lea rcx, [rsp + 0xb0]
call fcn.1400b5960
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1400af850
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0xd0]
call fcn.1400b49e0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x150]
call fcn.1400af510
mov rdx, rax
lea rcx, [0x140154f50]
call fcn.1400b5e40
lea rcx, [rsp + 0x150]
call fcn.1400b5930
lea rcx, [rsp + 0xd0]
call fcn.1400b5960
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x31]
call fcn.1400b68d0
mov rcx, rax
call fcn.1400b6060
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400b4670
lea r8, [rsp + 0xf0]
lea rdx, [0x140154f50]
lea rcx, [rsp + 0x170]
call fcn.1400b18f0
mov rdx, rax
lea rcx, [0x140155000]
call fcn.1400b5e40
lea rcx, [rsp + 0x170]
call fcn.1400b5930
lea rcx, [rsp + 0xf0]
call fcn.1400b5930
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x5c0
pop rdi
ret
Function at 0x1400afb30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x140154098]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0xa0]
call fcn.1400b4910
lea rdx, [0x1400dd7f1]
lea rcx, [rsp + 0xe0]
call fcn.1400b4670
movzx eax, byte [rsp + 0x1c8]
test eax, eax
je 0x1400afc7d
lea rdx, [0x1400dd7f2]
mov rcx, qword [rsp + 0x1d8]
call fcn.1400b1790
movzx eax, al
test eax, eax
je 0x1400afbc0
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.1400b5ea0
jmp 0x1400afbd5
mov rdx, qword [rsp + 0x1d8]
lea rcx, [rsp + 0xa0]
call fcn.1400b5ea0
mov r8, qword [rsp + 0x1c0]
lea rdx, [0x1400e46a4]
lea rcx, [rsp + 0x160]
call fcn.1400b1a90
lea r8, [0x1400e462c]
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.1400b1850
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1400b1800
lea r8, str._2_1
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400b1850
mov rdx, rax
mov rcx, qword [rsp + 0x1c0]
call fcn.1400b5e40
lea rcx, [rsp + 0x100]
call fcn.1400b5930
lea rcx, [rsp + 0x120]
call fcn.1400b5930
lea rcx, [rsp + 0x140]
call fcn.1400b5930
lea rcx, [rsp + 0x160]
call fcn.1400b5930
jmp 0x1400afcb6
mov r8, qword [rsp + 0x1c0]
lea rdx, [0x1400e46fc]
lea rcx, [rsp + 0x180]
call fcn.1400b1a90
mov rdx, rax
mov rcx, qword [rsp + 0x1c0]
call fcn.1400b5e40
lea rcx, [rsp + 0x180]
call fcn.1400b5930
mov rdx, qword [rsp + 0x1c0]
lea rcx, [rsp + 0xc0]
call fcn.1400bd9e0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xc0]
call fcn.1400ba2f0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
movzx eax, byte [rsp + 0x1d0]
test eax, eax
je 0x1400afd60
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0xc0]
call fcn.1400b5960
lea rcx, [rsp + 0xe0]
call fcn.1400b5930
lea rcx, [rsp + 0xa0]
call fcn.1400b5930
mov rcx, qword [rsp + 0x1c0]
call fcn.1400b5930
mov rcx, qword [rsp + 0x1d8]
call fcn.1400b5930
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400c03c0
add rsp, 0x1b0
pop rdi
ret