joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072d50
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rbp]
pop rbp
jmp fcn.140003594

Function at 0x140073ab0
Capabilities:
Check http status code

Disassembly:
jmp 0x140073ab0
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x30]
mov edx, 0x104
lea r8, [0x1408b7560]
lea rcx, [rbp + 0x110]
mov r9d, edx
mov eax, 0x305a
mov word [0x1408bab27], ax
mov byte [0x1408bab29], 0x30
mov dword [rcx - 0xc], 0x64
call fcn.140002c52
mov edx, eax
movsxd rdx, edx
lea rcx, [0x1408bab27]
mov qword [rbp + 0x440], rdx
mov edx, 2
mov qword [rbp + 0x448], rcx
lea rcx, [rbp + 0x438]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
mov qword [rcx + 0x18], 0xc
lea rax, [rbp + 0x110]
mov qword [rcx], rax
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x220]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rcx, [rbp + 0x220]
mov rdx, rax
call fcn.140001929
test al, 1
je 0x140073c5e
mov qword [rbp + 0x218], rbx
lea rcx, [rbp]
mov qword [rbp + 0x108], rsi
mov rbx, rcx
lea rsi, [0x1408bab27]
mov r10d, dword [rbp + 0x104]
lea r8d, [r10 + 1]
mov dword [rbp + 0x104], r8d
cmp r8d, 0xc8
jge 0x140073ccc
lea rdx, [0x1405ef1b0]
lea rcx, [rbp + 0x104]
mov r8d, 7
call fcn.140001a37
movzx eax, word [0x1405ef1b5]
mov word [0x1408bab28], ax
mov edx, 0x104
mov rcx, rbx
lea r8, [0x1408b7560]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x458]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
movsxd rax, eax
mov qword [rcx], rbx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xc
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x330]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rdx, eax
lea rcx, [rbp + 0x330]
call fcn.140001929
test al, 1
jne 0x140073b8d
mov rbx, qword [rbp + 0x218]
mov rsi, qword [rbp + 0x108]
mov rax, rsp
lea rcx, [0x1404b0dbc]
lea rdx, [0x1405ef0a0]
lea r8, [0x1404b0dc4]
mov r9d, 0x104
mov qword [rax + 0x20], 6
call fcn.1400038fa
cmp dword [0x140898f1c], 0
je 0x140073cbc
lea rcx, str.FILE_NAMING_PROBLEM
mov edx, 0x13
call fcn.140004ad9
lea rcx, [0x1408bab27]
lea rdx, [0x1404b0dc0]
mov r8d, 0xc
call fcn.140006316
mov byte [0x1408baf52], 0x2e
lea rsp, [rbp + 0x480]
pop rbp
ret
mov eax, 0x4ec4ec4f
imul r8d
sar r8d, 0x1f
sar edx, 3
sub edx, r8d
imul r9d, edx, 0xffffffe6
lea r8d, [rdx + 0x40]
mov byte [0x1405ef1b5], r8b
lea r10d, [r9 + r10 + 0x42]
mov byte [0x1405ef1b6], r10b
jmp 0x140073bc5
Function at 0x140073b71
Capabilities:
Check http status code

Disassembly:
jmp 0x140073ab0
push rbp
sub rsp, 0x4b0
lea rbp, [rsp + 0x30]
mov edx, 0x104
lea r8, [0x1408b7560]
lea rcx, [rbp + 0x110]
mov r9d, edx
mov eax, 0x305a
mov word [0x1408bab27], ax
mov byte [0x1408bab29], 0x30
mov dword [rcx - 0xc], 0x64
call fcn.140002c52
mov edx, eax
movsxd rdx, edx
lea rcx, [0x1408bab27]
mov qword [rbp + 0x440], rdx
mov edx, 2
mov qword [rbp + 0x448], rcx
lea rcx, [rbp + 0x438]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
mov qword [rcx + 0x18], 0xc
lea rax, [rbp + 0x110]
mov qword [rcx], rax
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x220]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rcx, [rbp + 0x220]
mov rdx, rax
call fcn.140001929
test al, 1
je 0x140073c5e
mov qword [rbp + 0x218], rbx
lea rcx, [rbp]
mov qword [rbp + 0x108], rsi
mov rbx, rcx
lea rsi, [0x1408bab27]
mov r10d, dword [rbp + 0x104]
lea r8d, [r10 + 1]
mov dword [rbp + 0x104], r8d
cmp r8d, 0xc8
jge 0x140073ccc
lea rdx, [0x1405ef1b0]
lea rcx, [rbp + 0x104]
mov r8d, 7
call fcn.140001a37
movzx eax, word [0x1405ef1b5]
mov word [0x1408bab28], ax
mov edx, 0x104
mov rcx, rbx
lea r8, [0x1408b7560]
mov r9d, edx
call fcn.140002c52
mov edx, 2
lea rcx, [rbp + 0x458]
lea r8, [0x1405ef0a0]
mov r9d, 0x104
movsxd rax, eax
mov qword [rcx], rbx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xc
call fcn.1400048cc
mov edx, 0x104
lea rcx, [rbp + 0x330]
lea r8, [0x1405ef0a0]
mov r9d, edx
call fcn.140002c52
movsxd rdx, eax
lea rcx, [rbp + 0x330]
call fcn.140001929
test al, 1
jne 0x140073b8d
mov rbx, qword [rbp + 0x218]
mov rsi, qword [rbp + 0x108]
mov rax, rsp
lea rcx, [0x1404b0dbc]
lea rdx, [0x1405ef0a0]
lea r8, [0x1404b0dc4]
mov r9d, 0x104
mov qword [rax + 0x20], 6
call fcn.1400038fa
cmp dword [0x140898f1c], 0
je 0x140073cbc
lea rcx, str.FILE_NAMING_PROBLEM
mov edx, 0x13
call fcn.140004ad9
lea rcx, [0x1408bab27]
lea rdx, [0x1404b0dc0]
mov r8d, 0xc
call fcn.140006316
mov byte [0x1408baf52], 0x2e
lea rsp, [rbp + 0x480]
pop rbp
ret
mov eax, 0x4ec4ec4f
imul r8d
sar r8d, 0x1f
sar edx, 3
sub edx, r8d
imul r9d, edx, 0xffffffe6
lea r8d, [rdx + 0x40]
mov byte [0x1405ef1b5], r8b
lea r10d, [r9 + r10 + 0x42]
mov byte [0x1405ef1b6], r10b
jmp 0x140073bc5
Function at 0x14007c370
Capabilities:
Create process on windows

Disassembly:
jmp 0x14007c370
push rbp
push rsi
push rdi
push r12
sub rsp, 0x298
lea rbp, [rsp + 0x30]
mov r12, rdx
mov rdi, rcx
lea rcx, [rbp]
mov edx, 0x12c
lea r8, [0x1404b1b74]
mov r9d, 4
lea rsi, [0x140000000]
mov byte [0x1405f824c], 0
call fcn.1400042eb
mov rax, qword [rbp + 0x120]
mov edx, dword [rbp + 0x128]
mov qword [0x1405f8100], rax
mov eax, 0x120
mov dword [0x1405f8108], edx
movups xmm0, xmmword [rbp + rax - 0x10]
movups xmm1, xmmword [rbp + rax - 0x20]
movups xmm2, xmmword [rbp + rax - 0x30]
movups xmm3, xmmword [rbp + rax - 0x40]
movups xmm4, xmmword [rbp + rax - 0x50]
movups xmm5, xmmword [rbp + rax - 0x60]
movups xmmword [rsi + rax + 0x5f7fd0], xmm0
movups xmmword [rsi + rax + 0x5f7fc0], xmm1
movups xmmword [rsi + rax + 0x5f7fb0], xmm2
movups xmmword [rsi + rax + 0x5f7fa0], xmm3
movups xmmword [rsi + rax + 0x5f7f90], xmm4
movups xmmword [rsi + rax + 0x5f7f80], xmm5
sub rax, 0x60
jne 0x14007c3cf
mov edx, 0x12c
lea rcx, [rbp + 0x130]
mov r8, rdi
mov r9, r12
call fcn.1400042eb
mov rax, qword [rbp + 0x250]
mov edx, dword [rbp + 0x258]
mov qword [0x1405f8240], rax
mov eax, 0x120
mov dword [0x1405f8248], edx
movups xmm0, xmmword [rbp + rax + 0x120]
movups xmm1, xmmword [rbp + rax + 0x110]
movups xmm2, xmmword [rbp + rax + 0x100]
movups xmm3, xmmword [rbp + rax + 0xf0]
movups xmm4, xmmword [rbp + rax + 0xe0]
movups xmm5, xmmword [rbp + rax + 0xd0]
movups xmmword [rsi + rax + 0x5f8110], xmm0
movups xmmword [rsi + rax + 0x5f8100], xmm1
movups xmmword [rsi + rax + 0x5f80f0], xmm2
movups xmmword [rsi + rax + 0x5f80e0], xmm3
movups xmmword [rsi + rax + 0x5f80d0], xmm4
movups xmmword [rsi + rax + 0x5f80c0], xmm5
sub rax, 0x60
jne 0x14007c459
mov rax, rsp
lea r9, [0x1405f824c]
lea rdx, [0x1405f7fe0]
lea r8, [0x1405f8120]
mov rcx, qword [0x1407619c8]
mov qword [rax + 0x20], r9
mov dword [rax + 0x28], 0
call sub.SHELL32.dll_ShellExecuteA
lea rsp, [rbp + 0x268]
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ea170
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
jmp 0x1400ea170
push rbp
push rbx
push r14
push r15
sub rsp, 0x58
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov ecx, 1
call sub.USER32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x1400ea333
mov rcx, qword [rbx]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x1400ea333
mov ecx, 1
call sub.USER32.dll_GetClipboardData
mov r15, rax
test r15, r15
je 0x1400ea333
mov rcx, r15
call sub.KERNEL32.dll_GlobalLock
mov rdx, rax
xor eax, eax
mov r14d, 1
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x10], rdi
mov rdi, rax
mov qword [rbp + 8], r12
lea r12, [0x140000000]
mov qword [rbp], r13
mov r13, rdx
test r13, r13
je 0x1400ea201
mov sil, byte [rdi + r13]
test sil, sil
je 0x1400ea2ce
jmp 0x1400ea2af
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404bfc40]
mov r8d, 3
mov r9d, 9
lea rsi, [0x1404bfca8]
lea r10, [0x1404bfcb0]
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x28], r10
call fcn.140002199
mov sil, byte [rdi]
test sil, sil
je 0x1400ea2ce
mov r14, rsp
mov ecx, 0x10100009
lea rdx, [0x1404bfc40]
mov r8d, 3
mov r9d, 9
lea r10, [0x1404bfcbc]
lea r11, [0x1404bfcc4]
mov qword [r14 + 0x20], r10
mov qword [r14 + 0x28], r11
call fcn.140002199
mov r14, rsp
mov ecx, 0x10100009
lea rdx, [0x1404bfc40]
mov r8d, 3
mov r9d, 9
lea r10, [0x1404bfcd0]
lea r11, [0x1404bfcd8]
mov qword [r14 + 0x20], r10
mov qword [r14 + 0x28], r11
call fcn.140002199
mov r14d, edi
mov byte [r12 + rdi + 0x638d80], sil
inc rdi
add r14d, 2
cmp rdi, 0x400
jb 0x1400ea1ea
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x10]
mov r12, qword [rbp + 8]
mov r13, qword [rbp]
mov rcx, r15
call sub.KERNEL32.dll_GlobalUnlock
mov r15d, 1
dec r14
jle 0x1400ea324
mov qword [rbp + 0x18], rsi
lea rsi, [0x140000000]
mov edx, 0x102
mov r9d, 1
movsx r8, byte [rsi + r15 + 0x638d7f]
mov rcx, qword [rbx]
call sub.USER32.dll_SendMessageA
inc r15
cmp r15, r14
jle 0x1400ea2fc
mov rsi, qword [rbp + 0x18]
lea rsp, [rbp + 0x28]
pop r15
pop r14
pop rbx
pop rbp
jmp fcn.1403fd75e
lea rsp, [rbp + 0x28]
pop r15
pop r14
pop rbx
pop rbp
ret
Function at 0x140117430
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
movabs rax, 0x5345524f4d545257
mov r10d, dword [rcx]
mov dword [0x140761844], r10d
mov qword [0x140761848], rax
lea r9d, [r10 - 1]
cmp r9d, 0x31
jbe 0x140117469
mov dword [0x140898f1c], 1
lea rsp, [rbp]
pop rbp
ret
movsxd r10, r10d
lea rax, [0x140000000]
imul r9, r10, 0x138
cmp qword [rax + r9 + 0x75da18], 0xffffffffffffffff
je 0x140117497
lea rax, [0x140000000]
cmp qword [rax + r9 + 0x75da30], 0
jne 0x1401174a3
mov dword [0x140898f1c], 0x2711
jmp 0x140117463
mov dword [0x140898f1c], 0
lea rsp, [rbp]
pop rbp
jmp 0x1400030c1
Function at 0x140144ab0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140144ab0
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x30]
movabs rax, 0x4e41524554495257
mov ecx, dword [rcx]
mov rsi, rdx
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
lea r10d, [rcx - 1]
cmp r10d, 0x31
jbe 0x140144af0
mov dword [0x140898f1c], 1
jmp 0x140144bd3
movsxd rcx, ecx
lea rax, [0x140000000]
imul rcx, rcx, 0x138
mov rax, qword [rax + rcx + 0x75da18]
cmp rax, 0xffffffffffffffff
je 0x140144bda
lea r9, [0x140000000]
mov rdx, r8
lea r8, [0x140646140]
mov qword [rbp + 8], rax
xor eax, eax
mov dword [0x140898f1c], eax
mov r10d, dword [r9 + rcx + 0x75da2c]
lea rcx, [rbp + 0x10]
mov qword [0x140646140], 0
mov dword [0x140646150], eax
mov dword [0x140646154], eax
mov dword [rcx], r10d
call fcn.140004368
cmp dword [0x140761850], 0
je 0x140144b84
lea rdx, [0x140646140]
lea rcx, [rbp + 8]
lea r8, [0x1404db9dc]
lea r9, [rbp + 4]
call fcn.140006447
mov eax, dword [rbp + 4]
jmp 0x140144b9c
xor r8d, r8d
xor r9d, r9d
mov edx, dword [0x140646140]
mov rcx, qword [rbp + 8]
call sub.KERNEL32.dll_SetFilePointer
mov dword [rbp + 4], eax
test eax, eax
jne 0x140144bad
call sub.KERNEL32.dll_GetLastError
mov dword [0x140898f1c], eax
jmp 0x140144bd3
mov rax, rsp
mov rdx, rsi
mov r8d, dword [rbp + 0x10]
lea r9, [rbp]
mov rcx, qword [rbp + 8]
mov qword [rax + 0x20], 0
call sub.KERNEL32.dll_WriteFile
mov dword [rbp + 4], eax
test eax, eax
je 0x140144ba0
lea rsp, [rbp + 0x18]
pop rsi
pop rbp
ret
mov dword [0x140898f1c], 0x72
jmp 0x140144bd3
Function at 0x140150e90
Capabilities:
Get common file path

Disassembly:
jmp 0x140150e90
push rbp
push r15
sub rsp, 0x58
lea rbp, [rsp + 0x30]
mov r15, rcx
mov byte [0x1406499cc], 0x5c
lea r9, [0x140000000]
cmp byte [r15], 0
jne 0x140150f29
mov ecx, 0x104
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov r10, rsp
mov rcx, r15
mov edx, 0x104
lea r8, [rbp + 0x20]
mov r9d, 1
xor eax, eax
mov byte [r8], al
mov dword [r10 + 0x20], eax
call fcn.140006019
xor r9d, r9d
lea rcx, [rbp]
movsxd rax, eax
mov edx, 2
dec rax
mov r8, r15
lea r10, [0x1406499cc]
cmovg r9, rax
mov qword [rbp + 8], r9
mov r9d, 0x104
mov qword [rcx], r15
mov qword [rbp + 0x10], r10
mov qword [rbp + 0x18], 1
call fcn.1400048cc
lea rsp, [rbp + 0x28]
pop r15
pop rbp
ret
mov eax, dword [r15 + 0x100]
mov dword [0x140568640], eax
mov eax, 0x100
movups xmm0, xmmword [r15 + rax - 0x10]
movups xmmword [r9 + rax + 0x568530], xmm0
movups xmm1, xmmword [r15 + rax - 0x20]
movups xmmword [r9 + rax + 0x568520], xmm1
movups xmm2, xmmword [r15 + rax - 0x30]
movups xmmword [r9 + rax + 0x568510], xmm2
movups xmm3, xmmword [r15 + rax - 0x40]
movups xmmword [r9 + rax + 0x568500], xmm3
sub rax, 0x40
jne 0x140150f3b
xor r9d, r9d
xor eax, eax
mov qword [rbp], r12
mov r12, r15
mov qword [rbp + 8], r13
mov r15, rax
mov qword [rbp + 0x10], r14
mov r13d, r9d
mov r10, rsp
lea rcx, [0x140568540]
mov edx, 0x104
lea r8, [0x1404dcefc]
mov r9d, 1
mov dword [r10 + 0x20], 0
call fcn.140006019
mov r14d, eax
test r14d, r14d
je 0x140151000
movsxd r14, r14d
lea r10, [0x140568540]
mov r9, r14
mov r11, rsp
neg r9
mov rcx, r10
add r9, 0x104
lea r8, [r10 + r14]
cmovle r9, r15
mov edx, 0x104
mov qword [r11 + 0x20], r15
call fcn.1400025f4
add r13d, r14d
jmp 0x140150f97
mov r9d, r13d
mov r10, rsp
movsxd r9, r9d
mov rax, r15
test r9, r9
mov r15, r12
mov rcx, r15
cmovle r9, rax
mov edx, 0x104
mov r8, r15
mov r12, qword [rbp]
mov r13, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov qword [r10 + 0x20], rax
call fcn.1400025f4
nop
jmp 0x140150f21
Function at 0x140164140
Capabilities:
Read file on windows

Disassembly:
jmp 0x140164140
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x30]
movabs rax, 0x444e415244414552
mov ecx, dword [rcx]
mov rbx, rdx
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
lea r10d, [rcx - 1]
cmp r10d, 0x31
jbe 0x140164183
mov dword [0x140898f1c], 1
jmp 0x1401642a6
movsxd rcx, ecx
lea rax, [0x140000000]
imul rcx, rcx, 0x138
mov rax, qword [rax + rcx + 0x75da18]
cmp rax, 0xffffffffffffffff
je 0x1401642ad
mov qword [rbp + 0x58], rax
lea rax, [0x140000000]
mov rdx, r8
lea r8, [rbp + 0x60]
mov dword [0x140898f1c], 0
mov r9d, dword [rax + rcx + 0x75da2c]
lea rcx, [rbp + 0x54]
mov dword [rcx], r9d
call fcn.140004368
lea r8, [0x1404df3ac]
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x60]
lea r9, [rbp + 0x68]
call fcn.140006447
cmp dword [rbp + 0x68], 0
je 0x14016429b
mov rax, rsp
mov rdx, rbx
mov r8d, dword [rbp + 0x54]
lea r9, [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
mov qword [rax + 0x20], 0
call sub.KERNEL32.dll_ReadFile
mov dword [rbp + 0x68], eax
test eax, eax
jne 0x1401642a6
mov rcx, rsp
lea rdx, [rbp + 0x30]
movabs r8, 0x801228384ff00
lea r9, [0x1404df3b0]
lea rax, str.READR_reclen_lbread
mov qword [rbp], 0
mov qword [rcx + 0x20], rdx
lea rcx, [rbp]
mov edx, 0xffffffff
mov qword [rbp + 0x30], 0x13
mov qword [rbp + 0x38], rax
call fcn.140002004
mov eax, dword [rbp + 0x54]
lea rcx, [rbp]
lea rdx, [0x1404df3b8]
lea r8, [rbp + 0x40]
mov dword [r8], eax
call fcn.140002f27
mov eax, dword [rbp + 0x50]
lea rcx, [rbp]
lea rdx, [0x1404df3c0]
lea r8, [rbp + 0x48]
mov dword [r8], eax
call fcn.140002f27
call sub.KERNEL32.dll_GetLastError
mov dword [0x140898f1c], eax
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
mov dword [0x140898f1c], 0x72
jmp 0x1401642a6
Function at 0x140164320
Capabilities:
Set registry value

Disassembly:
jmp 0x140164320
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x430
lea rbp, [rsp + 0x50]
mov r12, rcx
mov r15, r8
mov r14, rdx
mov edx, 2
lea rcx, [rbp + 0x390]
mov r8, r12
lea rax, [0x1404df3e8]
mov qword [rcx], rax
lea r10, [rbp + 0x3c0]
mov qword [rcx + 8], 0x11
lea r13, [0x140000000]
mov byte [rcx + 0x30], 0
mov qword [rcx + 0x10], r10
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov edx, 0x12c
lea rcx, [rbp + 0x130]
mov r8, r14
mov r9, qword [rbp + 0x430]
call fcn.1400042eb
mov rax, qword [rbp + 0x250]
mov ecx, dword [rbp + 0x258]
mov qword [0x14064bd00], rax
mov eax, 0x120
mov dword [0x14064bd08], ecx
movups xmm0, xmmword [rbp + rax + 0x120]
movups xmm1, xmmword [rbp + rax + 0x110]
movups xmm2, xmmword [rbp + rax + 0x100]
movups xmm3, xmmword [rbp + rax + 0xf0]
movups xmm4, xmmword [rbp + rax + 0xe0]
movups xmm5, xmmword [rbp + rax + 0xd0]
movups xmmword [r13 + rax + 0x64bbd0], xmm0
movups xmmword [r13 + rax + 0x64bbc0], xmm1
movups xmmword [r13 + rax + 0x64bbb0], xmm2
movups xmmword [r13 + rax + 0x64bba0], xmm3
movups xmmword [r13 + rax + 0x64bb90], xmm4
movups xmmword [r13 + rax + 0x64bb80], xmm5
sub rax, 0x60
jne 0x1401643bc
mov edx, 0x12c
lea rcx, [rbp + 0x260]
mov r8, r15
mov r9, qword [rbp + 0x438]
call fcn.1400042eb
mov rax, qword [rbp + 0x380]
mov ecx, dword [rbp + 0x388]
mov qword [0x14064be40], rax
mov eax, 0x120
mov dword [0x14064be48], ecx
movups xmm0, xmmword [rbp + rax + 0x250]
movups xmm1, xmmword [rbp + rax + 0x240]
movups xmm2, xmmword [rbp + rax + 0x230]
movups xmm3, xmmword [rbp + rax + 0x220]
movups xmm4, xmmword [rbp + rax + 0x210]
movups xmm5, xmmword [rbp + rax + 0x200]
movups xmmword [r13 + rax + 0x64bd10], xmm0
movups xmmword [r13 + rax + 0x64bd00], xmm1
movups xmmword [r13 + rax + 0x64bcf0], xmm2
movups xmmword [r13 + rax + 0x64bce0], xmm3
movups xmmword [r13 + rax + 0x64bcd0], xmm4
movups xmmword [r13 + rax + 0x64bcc0], xmm5
sub rax, 0x60
jne 0x140164462
mov r11, rsp
lea rcx, [0x14064be60]
mov edx, 0x12c
lea r8, [rbp + 0x3d0]
mov r9d, 1
xor r10d, r10d
xor eax, eax
mov qword [r8 - 0x20], r10
mov dword [rbp + 0x12c], eax
mov byte [r8], al
mov qword [r11 + 0x20], r10
call fcn.1400025f4
mov r10, rsp
lea r9, [rbp + 0x12c]
mov rcx, 0xffffffff80000001
mov rdx, r12
xor r8d, r8d
lea rax, [rbp + 0x3b0]
mov qword [r10 + 0x40], r9
lea r9, [0x14064be60]
mov dword [r10 + 0x20], 0
mov dword [r10 + 0x28], 0x4001f
mov qword [r10 + 0x30], 0
mov qword [r10 + 0x38], rax
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x1401645a4
lea r12, [0x14064bbe0]
mov edx, 0x12c
mov r8, r12
lea rcx, [rbp]
mov r9d, edx
call fcn.140002c52
mov rdx, rsp
xor r8d, r8d
mov r9d, 1
mov rcx, qword [rbp + 0x3b0]
mov qword [rdx + 0x20], r12
mov dword [rdx + 0x28], eax
lea rdx, [0x14064bd20]
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x1401645a4
mov rcx, qword [rbp + 0x3b0]
call sub.ADVAPI32.dll_RegCloseKey
lea rsp, [rbp + 0x3e0]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401b6b70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov r10, rcx
mov r9d, dword [rdx]
test r9d, r9d
jle 0x1401b6dc6
cmp r9d, 0x28
jl 0x1401b6dd0
mov r11, r10
and r11, 0xf
test r11d, r11d
je 0x1401b6bb1
test r11d, 3
jne 0x1401b6dd0
neg r11d
add r11d, 0x10
shr r11d, 2
lea eax, [r11 + 0x28]
cmp r9d, eax
jl 0x1401b6dd0
mov r8d, r9d
mov eax, 0x66666667
sub r8d, r11d
imul r8d
mov ecx, r8d
sar edx, 4
sar ecx, 0x1f
sub edx, ecx
xor ecx, ecx
lea eax, [rdx + rdx*4]
mov edx, r11d
shl eax, 3
sub r8d, eax
neg r8d
add r8d, r9d
test r11d, r11d
jbe 0x1401b6c0b
mov r11, rdx
mov eax, dword [r10 + rcx*4]
cdq
xor eax, edx
sub eax, edx
mov dword [r10 + rcx*4], eax
inc rcx
cmp rcx, r11
jb 0x1401b6bf3
mov rdx, r11
movsxd rax, r8d
pxor xmm0, xmm0
movdqu xmm2, xmmword [r10 + rdx*4]
movdqa xmm1, xmm0
movdqu xmm4, xmmword [r10 + rdx*4 + 0x10]
movdqa xmm3, xmm0
pcmpgtd xmm1, xmm2
pcmpgtd xmm3, xmm4
pxor xmm2, xmm1
pxor xmm4, xmm3
psubd xmm2, xmm1
psubd xmm4, xmm3
movdqu xmm1, xmmword [r10 + rdx*4 + 0x20]
movdqa xmm5, xmm0
movdqu xmm3, xmmword [r10 + rdx*4 + 0x30]
pcmpgtd xmm5, xmm1
movdqu xmmword [r10 + rdx*4], xmm2
movdqa xmm2, xmm0
pcmpgtd xmm2, xmm3
pxor xmm1, xmm5
pxor xmm3, xmm2
psubd xmm1, xmm5
psubd xmm3, xmm2
movdqa xmm2, xmm0
movdqu xmmword [r10 + rdx*4 + 0x20], xmm1
movdqa xmm5, xmm0
movdqu xmmword [r10 + rdx*4 + 0x30], xmm3
movdqu xmmword [r10 + rdx*4 + 0x10], xmm4
movdqa xmm4, xmm0
movdqu xmm1, xmmword [r10 + rdx*4 + 0x40]
movdqu xmm3, xmmword [r10 + rdx*4 + 0x50]
pcmpgtd xmm4, xmm1
pcmpgtd xmm2, xmm3
pxor xmm1, xmm4
pxor xmm3, xmm2
psubd xmm1, xmm4
psubd xmm3, xmm2
movdqa xmm2, xmm0
movdqu xmmword [r10 + rdx*4 + 0x40], xmm1
movdqa xmm4, xmm0
movdqu xmmword [r10 + rdx*4 + 0x50], xmm3
movdqu xmm1, xmmword [r10 + rdx*4 + 0x60]
movdqu xmm3, xmmword [r10 + rdx*4 + 0x70]
pcmpgtd xmm5, xmm1
pcmpgtd xmm2, xmm3
pxor xmm1, xmm5
pxor xmm3, xmm2
psubd xmm1, xmm5
psubd xmm3, xmm2
movdqa xmm2, xmm0
movdqu xmmword [r10 + rdx*4 + 0x60], xmm1
movdqu xmmword [r10 + rdx*4 + 0x70], xmm3
movdqu xmm1, xmmword [r10 + rdx*4 + 0x80]
nop
movdqu xmm3, xmmword [r10 + rdx*4 + 0x90]
pcmpgtd xmm4, xmm1
pcmpgtd xmm2, xmm3
pxor xmm1, xmm4
pxor xmm3, xmm2
psubd xmm1, xmm4
psubd xmm3, xmm2
movdqu xmmword [r10 + rdx*4 + 0x80], xmm1
movdqu xmmword [r10 + rdx*4 + 0x90], xmm3
add rdx, 0x28
cmp rdx, rax
jb 0x1401b6c12
lea edx, [r8 + 1]
cmp edx, r9d
ja 0x1401b6dc6
movsxd r9, r9d
sub r9, rax
cmp r9, 4
jl 0x1401b6dcc
mov ecx, r9d
xor edx, edx
and ecx, 0xfffffffc
lea rax, [r10 + rax*4]
movsxd rcx, ecx
movdqu xmm2, xmmword [rax]
movdqa xmm1, xmm0
pcmpgtd xmm1, xmm2
add rdx, 4
pxor xmm2, xmm1
psubd xmm2, xmm1
movdqu xmmword [rax], xmm2
add rax, 0x10
cmp rdx, rcx
jb 0x1401b6d7a
cmp rcx, r9
jae 0x1401b6dc6
movsxd r8, r8d
lea rax, [r10 + r8*4]
lea r8, [rax + rcx*4]
mov eax, dword [r8]
inc rcx
cdq
xor eax, edx
sub eax, edx
mov dword [r8], eax
add r8, 4
cmp rcx, r9
jb 0x1401b6daf
lea rsp, [rbp]
pop rbp
ret
xor ecx, ecx
jmp 0x1401b6d9f
xor r8d, r8d
cmp r9d, 1
jb 0x1401b6dc6
movsxd r9, r9d
xor ecx, ecx
jmp 0x1401b6d9f
Function at 0x1401bdd20
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1401bdd20
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x548
lea rbp, [rsp + 0x30]
mov r15, r8
mov r14, rdx
mov r13, rcx
mov r12d, 0xffffffff
test byte [0x140735de0], 1
jne 0x1401bdf89
mov rdx, r15
mov r8d, 0x104
mov rcx, qword [r13]
call sub.USER32.dll_GetWindowTextA
mov edx, 4
lea rcx, [rbp + 0x498]
lea r8, [0x140660594]
mov r9d, 0x32
lea rbx, str.Save_changes_to
lea rsi, [0x1404ea31c]
mov r10d, 1
lea rdi, [rbp + 0x500]
mov qword [rcx], rbx
mov qword [rcx + 8], 0x10
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0x104
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x68], 0
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], r10
call fcn.1400048cc
mov edx, 2
lea rcx, [rbp + 0x4d8]
lea r8, [0x1406605c6]
mov r9d, 5
lea rbx, [0x1404ea320]
lea rsi, [rbp + 0x510]
mov qword [rcx], rbx
mov qword [rcx + 8], 4
mov byte [rcx + 0x38], 0
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.1400048cc
lea rdx, [0x140660594]
lea r8, [0x1406605c6]
mov r9d, 0x33
mov rcx, qword [r13]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x1401bdf7c
mov rcx, r14
mov edx, 0x104
call fcn.140002c25
mov edx, 0x104
lea rsi, [rbp + 0x260]
mov rcx, rsi
mov r8, r14
mov r9d, edx
mov rdi, rsp
call fcn.140002c52
mov edx, 0x104
lea rcx, [rbp + 0x370]
mov r8, r15
mov r9d, edx
movsxd rbx, eax
mov qword [rbp + 0x478], rsi
mov qword [rbp + 0x480], rbx
call fcn.140002c52
movsxd rax, eax
lea rsi, [rbp + 0x370]
add rbx, rax
mov qword [rbp + 0x490], rax
mov rax, rbx
mov qword [rbp + 0x488], rsi
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov rsi, rax
lea rcx, [rbp + 0x478]
mov edx, 2
mov r8, rsi
mov r9, rbx
call fcn.1400048cc
mov edx, 0x12c
lea rcx, [rbp]
mov r8, rsi
mov r9, rbx
call fcn.1400042eb
mov rbx, rsp
mov rcx, r14
mov edx, 0x104
lea r8, [rbp]
mov r9d, 0x12c
mov qword [rbx + 0x20], 0
call fcn.1400025f4
mov rax, rdi
mov rsp, rax
mov edx, 0x12c
lea rcx, [rbp + 0x130]
mov r8, r15
mov r9d, 0x104
call fcn.1400042eb
mov rbx, rsp
mov rcx, r15
mov edx, 0x104
lea r8, [rbp + 0x130]
mov r9d, 0x12c
mov qword [rbx + 0x20], 0
call fcn.1400025f4
mov r8d, 0x104
mov rcx, r14
mov rdx, r15
mov r9, r8
call fcn.1400033be
test al, 1
je 0x1401bdf89
mov rcx, r14
mov rdx, r13
mov r8d, 0x104
call fcn.140002892
jmp 0x1401bdf89
xor r12d, r12d
cmp eax, 2
sete r12b
dec r12d
mov eax, r12d
lea rsp, [rbp + 0x518]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret