joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rcx
test rcx, rcx
jne 0x14000f816
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp word [rax + 0xe], 8
mov rbx, rax
je 0x14000f841
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x58], rsi
movsxd rsi, dword [rax + 4]
mov eax, dword [rax + 8]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x38], r12
cdq
xor eax, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
sub eax, edx
lea r12, [rsi*8 + 0x1f]
movsxd rdi, eax
shr r12, 5
lea rax, [rsi + rsi*2]
lea r15, [rax*8 + 0x1f]
shl r12, 2
shr r15, 5
shl r15, 2
mov r14, r15
imul r14, rdi
test r14, r14
je 0x14000f9e8
cmp rsi, 0xf3e58
ja 0x14000f9e8
cmp rdi, 0xf3e58
ja 0x14000f9e8
xor edx, edx
mov rax, r14
div rdi
cmp rax, r15
jb 0x14000f9e8
movabs rax, 0x7ffffffffffffbd7
cmp r14, rax
ja 0x14000f9e8
lea rdx, [r14 + 0x28]
mov ecx, 0x40
mov qword [rsp + 0x30], r13
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r13, rax
test rax, rax
jne 0x14000f92b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
mov dword [rax], 0x28
mov dword [rax + 4], esi
mov dword [rax + 8], edi
mov qword [rax + 0xc], 0x180001
mov dword [rdx + 0x14], r14d
mov ecx, dword [rbx + 0x18]
mov dword [rdx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
xor eax, eax
mov qword [rdx + 0x20], rax
mov dword [rdx + 0x1c], ecx
mov r10d, dword [rbx + 0x20]
add r10, 0xa
lea r11, [rdx + 0x28]
lea r10, [rbx + r10*4]
test rdi, rdi
je 0x14000f9ce
nop word [rax + rax]
mov r8, r10
mov rax, r11
test rsi, rsi
je 0x14000f9c3
mov r9, rsi
nop
movzx ecx, byte [r8]
lea rax, [rax + 3]
lea r8, [r8 + 1]
movzx edx, byte [rbx + rcx*4 + 0x28]
mov byte [rax - 3], dl
movzx ecx, byte [r8 - 1]
movzx edx, byte [rbx + rcx*4 + 0x29]
mov byte [rax - 2], dl
movzx ecx, byte [r8 - 1]
movzx edx, byte [rbx + rcx*4 + 0x2a]
mov byte [rax - 1], dl
dec r9
jne 0x14000f990
add r10, r12
add r11, r15
dec rdi
jne 0x14000f980
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, r13
jmp 0x14000f902
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x14000f907
Function at 0x140014720
Capabilities:
Read file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x48
movsxd rax, ecx
mov r14, rdx
imul rsi, rax, 0x2238
mov rax, qword [0x14007e0e8]
cmp qword [rsi + rax + 0x10], 0
jbe 0x140014891
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [0x14007e940]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140014797
xor eax, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rsi
ret
mov rax, qword [0x14007e0e8]
lea r8, [rsp + 0x74]
xor r9d, r9d
mov rcx, qword [rsi + rax + 8]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rcx
mov edx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
jne 0x1400147d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [0x14007e0e8]
mov ebp, dword [rsi + rax + 0x10]
mov ecx, ebp
call fcn.14001b9fc
mov rcx, rdi
mov rbx, rax
test rax, rax
jne 0x140014810
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop r14
pop rsi
ret
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x60], 0
jbe 0x14001487f
lea rdx, [0x140048708]
mov rcx, r14
call fcn.14001c9d0
mov rdi, rax
test rax, rax
jne 0x14001485b
mov rcx, rbx
call fcn.14001b9bc
jmp 0x1400147f7
mov rcx, qword [0x14007e0e8]
mov r9, rax
mov r8d, 1
mov edx, dword [rsi + rcx + 0x10]
mov rcx, rbx
call fcn.14001eddc
mov rcx, rdi
call fcn.14001c918
mov rcx, rbx
call fcn.14001b9bc
mov eax, 1
jmp 0x1400147f9
xor eax, eax
add rsp, 0x48
pop r14
pop rsi
ret
Function at 0x140014e60
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp dword [0x14007cb90], 0
je 0x140014e7e
xor eax, eax
cmp qword [0x14007cb78], rax
setne al
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
call fcn.1400150b0
lea rcx, str.USER32
mov dword [0x14007cb94], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140014f9c
lea rdx, [0x1400489d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb58], rax
test rax, rax
je 0x140014f9c
lea rdx, str.MonitorFromWindow
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb60], rax
test rax, rax
je 0x140014f9c
lea rdx, str.MonitorFromRect
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb68], rax
test rax, rax
je 0x140014f9c
lea rdx, str.MonitorFromPoint
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb70], rax
test rax, rax
je 0x140014f9c
lea rdx, str.EnumDisplayMonitors
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb80], rax
test rax, rax
je 0x140014f9c
lea rdx, str.EnumDisplayDevicesW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb88], rax
test rax, rax
je 0x140014f9c
cmp dword [0x14007cb94], 0
mov rcx, rbx
lea rdx, str.GetMonitorInfoW
jne 0x140014f75
lea rdx, str.GetMonitorInfoA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cb78], rax
test rax, rax
je 0x140014f9c
mov rbx, qword [rsp + 0x20]
mov eax, 1
mov dword [0x14007cb90], eax
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov dword [0x14007cb90], 1
mov qword [0x14007cb58], rax
mov qword [0x14007cb60], rax
mov qword [0x14007cb68], rax
mov qword [0x14007cb70], rax
mov qword [0x14007cb78], rax
mov qword [0x14007cb80], rax
mov qword [0x14007cb88], rax
add rsp, 0x28
ret
Function at 0x140015d10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x880
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov qword [r8], 0
mov rax, qword [0x14007e0e8]
movsxd rbp, ecx
imul rdi, rbp, 0x2238
cmp qword [rdi + rax + 0x10], 0
mov rsi, r8
mov rbx, rdx
jbe 0x140015ec7
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140015d70
cmp word [rbx + rax*2 - 2], 0x5c
je 0x140015da3
lea rcx, [rbx - 2]
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140015d90
mov eax, dword [0x140048ea8]
mov dword [rcx], eax
mov rcx, qword [0x14007e0e8]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x240]
add rcx, 0x1c
lea r8, [rsp + 0x450]
lea rdx, [rsp + 0x660]
add rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14001e930
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140015de0
lea r8, [rsp + 0x240]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x140015e00
lea rcx, [rbx - 2]
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140015e20
lea r8, [rsp + 0x30]
xor edx, edx
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x140015e32
mov rdx, qword [0x14007e0e8]
movsxd rcx, dword [rdx + rdi]
cmp ecx, 0x33
ja 0x140015e65
movabs r8, 0xc000484000400
bt r8, rcx
jb 0x140015e79
cmp ecx, 0x59
je 0x140015e79
mov rax, qword [rdx + rdi + 8]
mov qword [rsi], rax
mov eax, 1
jmp 0x140015ec9
cmp qword [0x14007cbb0], 0
je 0x140015e96
lea rdx, [0x14007e2e0]
mov rcx, rbx
call fcn.14001e4cc
test eax, eax
je 0x140015e72
cmp qword [0x14007cba8], 0
je 0x140015eb3
lea rdx, [0x14007e500]
mov rcx, rbx
call fcn.14001e4cc
test eax, eax
je 0x140015e72
mov rcx, rbx
call fcn.14001e840
mov rdx, rbx
mov ecx, ebp
call fcn.140014720
jmp 0x140015ec9
xor eax, eax
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14001bb50
mov rbx, qword [rsp + 0x8b8]
add rsp, 0x880
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016950
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
mov rcx, qword [0x14007cba8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140016ad8
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x467
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
sub ebx, eax
mov eax, 0x66666667
imul ebx
mov ebx, edx
sar ebx, 2
mov ecx, ebx
shr ecx, 0x1f
add ebx, ecx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400169d8
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400169fb
mov eax, 0x66666667
imul ebx
mov ebx, edx
sar ebx, 2
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov rcx, qword [0x14007cba8]
mov edi, 1
mov edx, 0x808
cmp ebx, edi
cmovg edi, ebx
xor r9d, r9d
lea r8d, [r9 + 0x65]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4ca
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp si, 1
jne 0x140016a43
add ebx, edi
jmp 0x140016a4a
test si, si
jne 0x140016a4a
sub ebx, edi
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x38]
cmp ebx, eax
jle 0x140016a85
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
jns 0x140016aa3
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x467
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
mov rcx, qword [0x14007cba8]
movsxd r9, ebx
xor r8d, r8d
mov edx, 0x807
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14007cba8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x806
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x14001efe8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001effe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001f000
xor eax, eax
test eax, eax
je 0x14001f010
mov ecx, eax
call fcn.140020930
or eax, 0xffffffff
jmp 0x14001f012
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400329b0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x1400329e3
call fcn.140036140
cmp byte [rbx + 0x58], 0
je 0x1400329dc
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140032a75
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x140032a5c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140032a0e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x140032a54
cmp eax, 2
je 0x140032a5c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032a00
dec eax
test eax, 0xfffffffd
jne 0x140032a00
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140032a00
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140032a00
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140032ab0
cmp eax, 0xcc
je 0x140032a97
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x13
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140032ab0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x140032ade
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x140032b8d
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x140032b5d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032b2f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x208]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x140032bb5
cmp eax, dword [rbx + 0x78]
jb 0x140032b10
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x140032b00
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x140032ba0
Function at 0x140032ab0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x1400329e3
call fcn.140036140
cmp byte [rbx + 0x58], 0
je 0x1400329dc
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140032a75
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x140032a5c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140032a0e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x140032a54
cmp eax, 2
je 0x140032a5c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032a00
dec eax
test eax, 0xfffffffd
jne 0x140032a00
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140032a00
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140032a00
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140032ab0
cmp eax, 0xcc
je 0x140032a97
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x13
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140032ab0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x140032ade
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x140032b8d
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x140032b5d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032b2f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x208]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x140032bb5
cmp eax, dword [rbx + 0x78]
jb 0x140032b10
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x140032b00
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x140032ba0
Function at 0x140037830
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rcx
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140037870
cmp word [rsp + rax*2 + 0x6e], 0x5c
je 0x1400378a3
lea rax, [rsp + 0x70]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140037890
mov ecx, dword [0x140048ea8]
mov dword [rax], ecx
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x6c]
movzx r8d, word [rsp + 0x6a]
movzx r9d, word [rsp + 0x68]
movzx eax, word [rsp + 0x6e]
movzx r10d, word [rsp + 0x66]
movzx r11d, word [rsp + 0x62]
movzx ebx, word [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x70]
lea r8, str._siv__04d_02d_02d_02d_02d_02d_03d.tmp
mov edx, 0x200
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call fcn.140037940
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14001bb50
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2d0
pop rdi
ret
Function at 0x414060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4141eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fd00
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4140c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4140d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4140f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414103
cmp rbx, 0x1000
jae 0x4140cb
jmp 0x41416d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414115
xor edx, edx
jmp 0x414164
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fd00
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4140f9
jmp 0x4140e8
call fcn.0045e600
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434100
lea rax, [0x004a3969]
mov ebx, 0x18
nop dword [rax]
call fcn.00434980
mov rax, qword [rsp + 0x38]
call fcn.004346c0
lea rax, [0x004a3c61]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434980
mov rax, qword [rsp + 0x30]
call fcn.004346c0
call fcn.00434340
call fcn.00434160
lea rax, [0x004a571b]
mov ebx, 0x21
call fcn.00432760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045af40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414060
Function at 0x414220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fd80
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414293
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4142a2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4142c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4142d5
cmp rbx, 0x1000
jae 0x414299
nop
jmp 0x414358
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4142ed
xor esi, esi
jmp 0x41434a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fd80
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4142cb
jmp 0x4142b6
call fcn.0045e600
xorps xmm15, xmm15
mov r14, qword [0x00586568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4143e0
nop dword [rax + rax]
call fcn.00434100
lea rax, [0x004a3c7a]
mov ebx, 0x19
call fcn.00434980
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004346c0
lea rax, [0x004a3c61]
mov ebx, 0x19
call fcn.00434980
mov eax, dword [rsp + 0x34]
call fcn.004346c0
nop
call fcn.00434340
call fcn.00434160
lea rax, [0x004a135f]
mov ebx, 0xd
call fcn.00432760
nop dword [rax + rax]
cmp eax, 0x5af
je 0x414380
call fcn.00434100
lea rax, [0x004a3c7a]
mov ebx, 0x19
call fcn.00434980
mov rax, qword [rsp + 0x38]
call fcn.004346c0
lea rax, [0x004a3c61]
mov ebx, 0x19
call fcn.00434980
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004346c0
call fcn.00434340
call fcn.00434160
lea rax, [0x004a507d]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00432760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045af40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414220