joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c000
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
lea rbp, [rax - 0xf8]
sub rsp, 0x1f0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rbx, r8
mov rsi, rcx
lea eax, [rdx + rdx*2]
shl eax, 4
movsxd rdx, eax
add rdx, qword [r8 + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1400432d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbp - 0x70], xmm0
mov rdi, qword [rbx + 8]
add rdi, 0x250
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm0
mov rcx, qword [0x1400e0f88]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14003c0a2
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x48], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x30
mov eax, dword [0x1400e0e80]
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x60], cl
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x3b2c22c
mov rcx, qword [0x1400e0e88]
call qword [0x1400e12e8]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbp]
movups xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14003b6a0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
movups xmm8, xmmword [rax + 0x20]
movups xmm9, xmmword [rax + 0x30]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14003b6a0
movaps xmmword [rbp - 0x50], xmm6
movaps xmmword [rbp - 0x40], xmm7
movaps xmmword [rbp - 0x30], xmm8
movaps xmmword [rbp - 0x20], xmm9
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x60], xmm1
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x70]
call fcn.14003b820
movups xmm1, xmmword [rax + 0x30]
movss dword [rsi], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
movss dword [rsi + 4], xmm0
shufps xmm1, xmm1, 0xaa
movss dword [rsi + 8], xmm1
mov rcx, rbx
call fcn.14003bc30
mov rax, rsi
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret
Function at 0x1400425c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x24
lea r8, [0x14004794e]
lea rdx, str.Press_Ok_next_to_the_lobby
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x140042631
lea rcx, str.VALORANT_Win64_Shipping.exe
call fcn.14003aa60
nop
cmp dword [0x1400e0e80], 0
je 0x14004262f
mov edx, 0x64
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140041fb0
nop
jmp 0x14004263a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x14004263e
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400430d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x88], 0
mov rcx, qword [0x1400e0f88]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140043101
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov r9d, 0x28
mov qword [rsp + 0x20], rcx
mov edx, 0x3b2c22c
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400e0e80]
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400e0e88]
mov qword [rsp + 0x58], 4
mov dword [rsp + 0x40], eax
call qword [0x1400e12e8]
movss xmm0, dword [rsp + 0x88]
add rsp, 0x70
pop rbx
ret
Function at 0x140043180
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x88], 0
mov rcx, qword [0x1400e0f88]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400431b1
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov r9d, 0x28
mov qword [rsp + 0x20], rcx
mov edx, 0x3b2c22c
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400e0e80]
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400e0e88]
mov qword [rsp + 0x58], 4
mov dword [rsp + 0x40], eax
call qword [0x1400e12e8]
movss xmm0, dword [rsp + 0x88]
xor eax, eax
movss xmm2, dword [0x1400b2250]
movaps xmm1, xmm0
comiss xmm1, xmm2
jb 0x14004324e
subss xmm1, xmm2
comiss xmm1, xmm2
jae 0x14004324e
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttss2si rdx, xmm1
movabs r8, 0xffffff8000000000
movabs r9, 0xffffff7fffffffff
add rdx, rax
movabs rax, 0xffffffff00000000
mov rcx, rdx
and rcx, rax
lea rax, [rcx + r8]
test r9, rax
jne 0x1400432c4
mov rax, rdx
add rcx, r8
and eax, 0xffffff
xorps xmm0, xmm0
add rax, qword [0x1400e0f58]
test r9, rcx
cmove rdx, rax
test rdx, rdx
js 0x1400432af
cvtsi2ss xmm0, rdx
add rsp, 0x70
pop rbx
ret
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x1400432d0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xa0
xorps xmm0, xmm0
mov rbx, rcx
mov rcx, qword [0x1400e0f88]
xorps xmm1, xmm1
movups xmmword [rax - 0x40], xmm0
mov rdi, rdx
movups xmmword [rax - 0x30], xmm1
movups xmmword [rax - 0x20], xmm0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140043314
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov r9d, 0x28
mov qword [rsp + 0x20], rcx
mov edx, 0x3b2c22c
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400e0e80]
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400e0e88]
mov qword [rsp + 0x58], 0x30
mov dword [rsp + 0x40], eax
call qword [0x1400e12e8]
movups xmm0, xmmword [rsp + 0x68]
mov rax, rbx
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
Function at 0x1400433b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400e0f88]
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400433e4
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400e0e88]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov r9d, 0x28
mov eax, dword [0x1400e0e80]
mov edx, 0x3b2c22c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x61], edi
mov word [rsp + 0x65], di
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 8
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x20], rdi
call qword [0x1400e12e8]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x140043470
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400e0f88]
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400434a4
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400e0e88]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov r9d, 0x28
mov eax, dword [0x1400e0e80]
mov edx, 0x3b2c22c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x61], edi
mov word [rsp + 0x65], di
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 8
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x20], rdi
call qword [0x1400e12e8]
mov r8, qword [rsp + 0x88]
movabs rax, 0xffffffff00000000
mov rcx, r8
movabs rdx, 0xffffff8000000000
and rcx, rax
movabs r9, 0xffffff7fffffffff
lea rax, [rcx + rdx]
test r9, rax
jne 0x14004355f
add rdx, rcx
mov rcx, r8
and ecx, 0xffffff
add rcx, qword [0x1400e0f58]
test r9, rdx
cmove r8, rcx
mov rbx, qword [rsp + 0x80]
mov rax, r8
add rsp, 0x70
pop rdi
ret
Function at 0x140043570
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400e0f88]
mov dword [rsp + 0x88], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400435a3
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400e0e88]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov r9d, 0x28
mov eax, dword [0x1400e0e80]
mov edx, 0x3b2c22c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x61], edi
mov word [rsp + 0x65], di
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 4
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x20], rdi
call qword [0x1400e12e8]
movsxd rcx, dword [rsp + 0x88]
movabs rax, 0xffffffff00000000
mov r8, rcx
movabs r9, 0xffffff8000000000
and r8, rax
movabs r10, 0xffffff7fffffffff
mov rdx, rcx
lea rax, [r8 + r9]
test r10, rax
jne 0x140043664
mov rax, rdx
lea rcx, [r8 + r9]
and eax, 0xffffff
add rax, qword [0x1400e0f58]
test r10, rcx
cmove rdx, rax
mov rcx, rdx
mov rbx, qword [rsp + 0x80]
mov eax, ecx
add rsp, 0x70
pop rdi
ret

Function at 0x1400450d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140045122
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140045122
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140045122
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140045122
cmp dword [rcx + 0x84], 0xe
jbe 0x140045122
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140045124
xor al, al
add rsp, 0x28
ret
Function at 0x100001844
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
mov ebx, eax
call fcn.1000015b0
and qword [rsp + 0x30], 0
lea rcx, [0x100001328]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000018ba
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.1000015b0
mov eax, 0xc0000034
jmp 0x10000191b
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, 0x10
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000018fe
cmp dword [rsp + 0x58], 0x10
jne 0x1000018fe
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1000015b0
xor eax, eax
jmp 0x10000191b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1000015b0
mov eax, 0xc0000102
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x100001934
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov rbp, rcx
mov ecx, 0x8001
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
mov esi, eax
call fcn.1000015b0
and qword [rsp + 0x30], 0
lea rcx, [0x100001338]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x100001a41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x50
jne 0x100001a2a
lea rcx, [0x100001358]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x100001358]
lea rcx, [0x100001338]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100001a07
and qword [rsp + 0x30], 0
lea rcx, [0x100001338]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x100001a11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100001a2a
mov edx, 0x5ee
mov r9d, 0x40
mov rcx, rbp
lea r8d, [rdx - 0xf]
call fcn.100001634
xor ebx, ebx
test ebx, ebx
je 0x100001a41
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call fcn.1000015b0
mov eax, ebx
jmp 0x100001aa3
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, 0x10
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100001a85
cmp dword [rsp + 0x70], 0x10
jne 0x100001a85
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1000015b0
xor eax, eax
jmp 0x100001aa3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1000015b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x100001abc
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4c0
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rdi, rdx
mov edx, 0xca
mov r13, r8
mov rsi, rcx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov r12d, 2
cmp eax, 1
jne 0x100001b04
mov ecx, r12d
jmp 0x100001b1f
mov edx, 0xd2
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ecx, 1
lea edx, [rcx + 2]
cmp eax, ecx
cmove ecx, edx
mov dword [rdi], ecx
sub ecx, 1
je 0x100001cfa
sub ecx, 1
je 0x100001b64
cmp ecx, 1
je 0x100001cfa
movabs rax, 1
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1000038f0
add rsp, 0x4c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edi, 0x104
lea r8, [rsp + 0x2a0]
mov rcx, rsi
lea edx, [rdi - 0x37]
mov r9d, edi
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
lea r8, [rsp + 0x90]
lea edx, [rdi - 0x35]
mov r9d, edi
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor ebx, ebx
mov r14d, eax
cmp ebp, eax
jne 0x100001bd1
lea rcx, [rsp + 0x2a0]
lea rax, [rsp + 0x90]
sub rax, rcx
movzx edx, word [rcx]
movzx edi, word [rcx + rax]
sub edx, edi
jne 0x100001bc7
add rcx, r12
test edi, edi
jne 0x100001bb5
mov r12d, 1
cmp edx, ebx
je 0x100001bd4
mov r12d, ebx
lea rax, [rsp + 0x90]
cmp word [rsp + 0x90], bx
je 0x100001bf7
mov ecx, 0x20
mov word [rax], cx
add rax, 2
cmp word [rax], bx
jne 0x100001be6
mov edi, 0xcd
lea r8, [rsp + 0x90]
mov rcx, rsi
mov edx, edi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [rsp + 0x90]
lea edx, [rdi + 2]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x100001320]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x100001320]
lea edx, [rdi + 2]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
mov rcx, r14
add rcx, rcx
lea rdi, [rsp + 0x90]
rep stosb byte [rdi], al
cmp r12d, ebx
jne 0x100001cac
mov edx, 0x5e0
lea r9d, [rax + 0x10]
mov rcx, rsi
lea r8d, [rdx - 3]
call fcn.100001634
mov edx, 0xcd
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, rbp
lea rdi, [rsp + 0x2a0]
add rcx, rcx
xor eax, eax
rep stosb byte [rdi], al
movabs rax, 2
jmp 0x100001b42
lea rcx, [rsp + 0x20]
call fcn.100003d60
lea r8d, [rbp + rbp]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x20]
call fcn.100004530
lea rcx, [rsp + 0x20]
call fcn.1000046a0
mov rcx, rbp
lea rdi, [rsp + 0x2a0]
movdqu xmm0, xmmword [rsp + 0x78]
add rcx, rcx
xor eax, eax
movdqu xmmword [r13], xmm0
rep stosb byte [rdi], al
jmp 0x100001b38
mov edx, 0x10
mov rcx, r13
call sub.ADVAPI32.dll_SystemFunction036
xor ebx, ebx
cmp al, bl
jne 0x100001b38
lea r8d, [rbx + 8]
mov edx, 0x5e2
mov rcx, rsi
call fcn.1000016ec
mov rax, r12
jmp 0x100001b42
Function at 0x100003524
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x48]
lea rdx, [0x100001380]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
cmp eax, ebx
je 0x100003561
mov eax, 0xc0000001
jmp 0x1000035a1
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [0x100001418]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x100003594
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1000038f0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100006110]
jne 0x10000390b
rol rcx, 0x10
test cx, 0xffff
jne 0x100003907
ret 0
ror rcx, 0x10
jmp 0x100003bfc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100006250]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100006348]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100003c81
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100006250]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100003ca3
mov rax, qword [rsp + 0x88]
mov qword [0x100006348], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000062e8], rax
mov rax, qword [0x100006348]
mov qword [0x1000061c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000062d0], rax
mov dword [0x1000061b0], 0xc0000409
mov dword [0x1000061b4], 1
mov rax, qword [0x100006110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100006118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001310]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100003a98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100003ae5
cmp rcx, 0xffffffffffffffff
je 0x100003ae5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100003add
cmp dword [rcx + 0x3c], edx
jl 0x100003add
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100003add
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100003ae5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180004c00
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x18033ba94]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.1800d9680
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x18033ba94]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180004d90
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x180004dac
cmp rcx, r8
jl 0x180004d9f
mov qword [rdx + 0x80], rcx
test dword [0x180335098], 1
je 0x180004ddb
cmp byte [rsp + 0xd0], 0
je 0x180004ddb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180004900
mov rsp, r8
jmp rax