joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088644
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [rcx + 0x2c8], 0
mov rdi, rcx
jne 0x140088697
cmp dword [rcx + 0x2cc], 0
jne 0x140088697
mov rax, qword [0x140172270]
cmp byte [rax + 0x4f], 0
je 0x140088697
call fcn.140066cf4
test al, al
je 0x140088697
mov bpl, 1
jmp 0x14008869a
xor bpl, bpl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movsx esi, ax
xorps xmm0, xmm0
mov rax, qword [rdi + 0x10]
mov ebx, 1
sar esi, 0xf
and esi, 0xfffffffe
mov qword [rsp + 0x20], rax
inc esi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
test bpl, bpl
je 0x1400886f8
mov rax, qword [rdi + 0x50]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov ebx, 2
call fcn.1400770e4
test al, al
je 0x1400886f8
mov rax, qword [rdi + 0x38]
mov ebx, 3
mov qword [rsp + 0x30], rax
cmp byte [rdi + 0x90], 0
je 0x14008871e
cmp byte [rdi + 0x91], 0
je 0x14008871e
mov rax, qword [rdi + 0x88]
mov ecx, ebx
inc ebx
mov rax, qword [rax + 0x48]
mov qword [rsp + rcx*8 + 0x20], rax
mov rax, qword [0x140172270]
cmp byte [rax + 0x50], 0
je 0x14008873f
mov rax, qword [rdi + 0xa8]
mov ecx, ebx
inc ebx
mov rax, qword [rax + 0x48]
mov qword [rsp + rcx*8 + 0x20], rax
cmp ebx, 5
jbe 0x140088754
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140088754
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call qword [sym.imp.USER32.dll_GetFocus]
xor edx, edx
mov r8d, ebx
test ebx, ebx
je 0x140088776
xor ecx, ecx
cmp qword [rsp + rcx*8 + 0x20], rax
je 0x140088776
inc edx
inc rcx
cmp rcx, r8
jl 0x140088765
cmp edx, ebx
jne 0x14008878b
mov eax, esi
neg eax
jns 0x140088787
lea ecx, [rbx + rbx]
add eax, ecx
js 0x140088783
xor edx, edx
div ebx
lea eax, [rdx + rsi]
test eax, eax
jns 0x140088799
lea ecx, [rbx + rbx]
add eax, ecx
js 0x140088795
xor edx, edx
div ebx
movsxd rcx, edx
mov rcx, qword [rsp + rcx*8 + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400887d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x2cc]
mov r15, r8
sub eax, 2
mov rdi, rdx
mov rsi, rcx
cmp eax, 1
jbe 0x14008883d
cmp rdx, 0x1b
jne 0x14008885a
mov rdx, qword [rcx + 0x1c0]
mov r9b, 1
mov r8, rdx
shr r8, 0x20
call fcn.14002305c
and dword [rsi + 0x1b8], 0
mov ecx, 0x7f00
and qword [rsi + 0x330], 0
and qword [rsi + 0x1f0], 0
call fcn.1400b8ef0
mov al, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, 0x10
shr bp, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rsi
call fcn.140066cf4
test al, al
je 0x140088a3a
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008889d
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov r14, rax
jmp 0x1400888a0
xor r14d, r14d
mov rcx, qword [rsi]
test rcx, rcx
je 0x140088925
mov rax, qword [rcx]
call qword [rax + 0xf8]
test rax, rax
je 0x140088925
lea rax, [rdi - 0x21]
cmp rax, 7
jbe 0x1400888d0
cmp rdi, 0x6a
je 0x1400888d0
cmp rdi, 0x6f
jne 0x140088a3a
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400888e3
mov rax, qword [rcx]
call qword [rax + 0xf8]
jmp 0x1400888e5
xor eax, eax
mov rcx, qword [rax + 0x80]
test rcx, rcx
je 0x14008883d
cmp byte [0x140172477], 0
jne 0x14008883d
mov r9, r15
mov byte [0x140172477], 1
mov r8, rdi
mov edx, 0x100
call fcn.1400a6610
mov byte [0x140172477], 0
jmp 0x14008883d
cmp rdi, 0x26
jne 0x140088934
lea rcx, str.VK_UP_n
jmp 0x14008898c
cmp rdi, 0x28
jne 0x140088943
lea rcx, str.VK_DOWN_n
jmp 0x14008898c
cmp rdi, 0x21
jne 0x14008895b
test bpl, bpl
je 0x140088a3a
lea rcx, str.CTRL__VK_PRIOR_n
jmp 0x14008898c
cmp rdi, 0x22
jne 0x140088973
test bpl, bpl
je 0x140088a3a
lea rcx, str.CTRL__VK_NEXTds_n
jmp 0x14008898c
cmp rdi, 0x24
jne 0x140088996
lea rcx, str.CTRL__VK_HOME_n
test bpl, bpl
jne 0x14008898c
lea rcx, str.VK_HOME_n
call fcn.1400b3458
jmp 0x14008883d
cmp rdi, 0x23
jne 0x1400889c5
lea rcx, str.CTRL__VK_END_n
test bpl, bpl
jne 0x1400889af
lea rcx, str.VK_END_n
call fcn.1400b3458
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0xe0]
jmp 0x14008883d
cmp rdi, 0x25
jne 0x1400889d4
lea rcx, str.VK_LEFT_n
jmp 0x14008898c
cmp rdi, 0x27
jne 0x1400889e3
lea rcx, str.VK_RIGHT_n
jmp 0x14008898c
cmp rdi, 0x6a
jne 0x140088a0a
test r14, r14
je 0x140088a3a
lea rcx, str.VK_MULTIPLY_n
call fcn.1400b3458
lea edx, [rdi - 0x10]
mov rcx, r14
call fcn.140034408
jmp 0x14008883d
cmp rdi, 0x6f
jne 0x140088a3a
test r14, r14
je 0x140088a3a
lea rcx, str.VK_DIVIDE_n
call fcn.1400b3458
mov edx, 0xffffffa6
mov rcx, r14
call fcn.140034408
mov byte [0x14017247c], 1
jmp 0x14008883d
xor al, al
jmp 0x14008883f
Function at 0x140088b34
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov r14, rcx
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x50]
cmp eax, 1
je 0x140088b6e
cmp eax, 4
je 0x140088b6e
xor sil, sil
jmp 0x140088b71
mov sil, 1
mov rcx, qword [r14]
test rcx, rcx
je 0x140088cd2
mov rax, qword [rcx]
call qword [rax + 0xf0]
mov rdi, rax
test rax, rax
je 0x140088cd2
test sil, sil
jne 0x140088cd2
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov rdx, qword [rbx]
mov rcx, rbx
movzx r13d, ax
shr r13w, 0xf
xor r13b, 1
call qword [rdx + 0x28]
mov rdx, qword [rdi]
mov rcx, rdi
mov r12d, eax
call qword [rdx + 0x50]
cmp eax, 3
je 0x140088bd6
cmp eax, 6
je 0x140088bd6
xor cl, cl
jmp 0x140088be5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
cmp eax, 1
sete cl
mov esi, 2
test r13b, r13b
je 0x140088c61
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + SafeArrayCopy]
mov rdx, qword [rdi]
mov rcx, rdi
mov r15d, eax
call qword [rdx + 0x50]
mov ebp, eax
cmp eax, 1
je 0x140088c5f
cmp eax, 4
je 0x140088c5f
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x28]
cmp eax, r15d
jne 0x140088c22
mov cl, 1
jmp 0x140088c61
mov edx, r15d
mov rcx, rdi
call fcn.140031220
movss xmm0, dword [0x140156834]
comiss xmm0, dword [rax + 0x30]
ja 0x140088c5f
cmp ebp, 3
je 0x140088c4a
cmp ebp, 6
je 0x140088c4a
xor r8b, r8b
jmp 0x140088c4d
mov r8b, 1
mov edx, esi
mov ecx, r15d
call fcn.140030d68
cmp eax, r15d
setge cl
jmp 0x140088c61
xor cl, cl
test cl, cl
jne 0x140088ce9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
cmp eax, 3
je 0x140088c81
cmp eax, 6
je 0x140088c81
mov esi, 3
mov r8b, 1
mov edx, esi
mov rcx, r14
call fcn.14007fdcc
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rax + 0x28]
call rdx
test r13b, r13b
je 0x140088cbd
cmp r12d, eax
jl 0x140088ce9
cmp r12d, 1
jg 0x140088caf
cmp esi, 3
jne 0x140088ce9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_203]
jmp 0x140088ce9
cmp r12d, eax
jg 0x140088ce9
mov rcx, qword [r14]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xd0]
jmp 0x140088ce9
cmp dword [r14 + 0x2cc], 0
je 0x140088ce9
mov edx, 2
mov rcx, r14
call fcn.1400670f8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140089228
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x2cc]
mov rsi, r8
sub eax, 2
mov rbx, rdx
mov rdi, rcx
cmp eax, 1
jbe 0x140089376
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
movzx ebp, ax
call qword [sym.imp.USER32.dll_GetKeyState]
xor r14d, r14d
cmp rbx, 0x100
jb 0x1400892a5
test rsi, rsi
je 0x1400892c9
test bp, bp
js 0x1400892c9
test ax, ax
js 0x1400892c9
sar rsi, 0x10
lea edx, [r14 + 1]
movzx ecx, sil
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x1400892c9
mov ebx, eax
mov rax, rbx
cmp rbx, 9
je 0x1400892c1
cmp rax, 0x1b
jne 0x1400892c9
mov rcx, rdi
call fcn.140088a44
jmp 0x140089380
mov rcx, rdi
call fcn.140088644
mov rcx, rdi
call fcn.140066cf4
test al, al
je 0x140089380
movzx ecx, bx
call qword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x140089306
mov edx, 1
mov word [rsp + 0x40], bx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x42], r14w
call qword [sym.imp.USER32.dll_CharLowerBuffW]
movzx ebx, word [rsp + 0x40]
sub rbx, 0x2b
je 0x140089330
sub rbx, 2
je 0x14008936e
sub rbx, 2
je 0x140089354
sub rbx, 0xe
je 0x140089330
sub rbx, 0x25
je 0x14008934a
sub rbx, 0x7e
je 0x140089330
cmp rbx, 4
jne 0x140089380
mov r8d, 0x123
mov rcx, qword [rdi + 0x10]
mov edx, 0x111
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140089380
mov rcx, rdi
call fcn.140088b34
jmp 0x140089380
cmp byte [0x14017247c], r14b
jne 0x140089365
mov rcx, rdi
call fcn.14007713c
mov byte [0x14017247c], r14b
jmp 0x140089380
mov r8d, 0x124
jmp 0x140089336
mov edx, 1
call fcn.1400670f8
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14008c948
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push rbx
sub rsp, 0x90
xor edx, edx
lea rcx, str.ShowCrashHandlerMessage___n
call fcn.1400b31d8
mov eax, dword [0x14016ee08]
shr eax, 1
test al, 1
jne 0x14008c981
lea rcx, str.ShowCrashHandlerMessage:_skipping_beacuse__CanAccessDisk___n
xor edx, edx
add rsp, 0x90
pop rbx
jmp fcn.1400b31d8
call fcn.140080808
movzx r9d, al
lea r8, str.SumatraPDF_crashed
shl r9d, 0x14
lea rdx, str.Were_sorry__SumatraPDF_crashed._n_nPress_Cancel_to_see_crash_report.
or r9d, 0x50011
xor ecx, ecx
call fcn.1400b9a40
cmp eax, 2
jne 0x14008ca7b
mov rcx, qword [0x140172248]
test rcx, rcx
jne 0x14008c9c8
lea rcx, str.ShowCrashHandlerMessage:__gCrashFilePath_n
jmp 0x14008c972
lea r8, str.open
xor edx, edx
call fcn.1400b6dc4
mov ebx, 0x70
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14012a960
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], 0x400
call fcn.1400b2af0
or rbx, 0xffffffffffffffff
lea rcx, str.open
mov rdx, rbx
mov r8, rax
call fcn.1400be600
mov qword [rsp + 0x30], rax
call fcn.1400b2af0
mov r8, rax
lea rcx, str.https:__www.sumatrapdfreader.org_docs_Submit_crash_report.html
mov rdx, rbx
call fcn.1400be600
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14008ca7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.open
xor r8d, r8d
lea rdx, str.https:__www.sumatrapdfreader.org_docs_Submit_crash_report.html
mov ebx, eax
lea rcx, str.LaunchFile:_ShellExecuteExW_path:__s_params:__s_verb:__s_n
call fcn.1400b3458
mov ecx, ebx
call fcn.1400b5d58
add rsp, 0x90
pop rbx
ret
Function at 0x14008f528
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, rcx
call fcn.1400b682c
mov rcx, rax
mov rbx, rax
call fcn.1400b0940
or r13, 0xffffffffffffffff
test rbx, rbx
je 0x14008f56e
mov rdx, r13
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14008f563
jmp 0x14008f570
xor edx, edx
mov rcx, rbx
call fcn.1400b3a48
mov edx, eax
lea rcx, str.SumatraPDF__08x
call fcn.1400b2dac
xor ebx, ebx
mov r15, rax
lea r14d, [rbx + 3]
test r15, r15
jne 0x14008f598
xor eax, eax
jmp 0x14008f5ab
call fcn.1400b2af0
mov r8, rax
mov rdx, r13
mov rcx, r15
call fcn.1400be600
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, r13
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x14008f65d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
mov qword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x14008f60e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008f65d
cmp ebp, 0xb7
jne 0x14008f680
mov ebp, dword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008f640
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x68], ebp
je 0x14008f673
xor r9d, r9d
lea r8, str.SUMATRA_PDF_FRAME
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
jne 0x14008f62c
sub r14d, 1
js 0x14008f695
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008f58f
mov ecx, ebp
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rax, rbx
jmp 0x14008f697
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [r12], rdi
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140090164
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
movsxd r15, edx
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x74006e
mov dword [rbp - 0x1c], 0x6c0064
xor r12d, r12d
mov dword [rbp - 0x18], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp - 0x28]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rdi
mov rdx, qword [rbp - 0x30]
mov r9d, r15d
mov r8, r14
mov qword [rsp + 0x20], r12
mov rcx, rbx
call rsi
call qword [rbp - 0x30]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140099340
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor edx, edx
lea rcx, [0x14013cb80]
mov r9d, edx
lea r10, [0x14013cc12]
mov r8, rcx
cmp ax, word [r8]
je 0x140099398
inc r9d
add r8, 2
cmp r8, r10
jl 0x140099360
mov r8d, 0x3ff
and ax, r8w
cmp ax, word [rcx]
je 0x14009939b
inc edx
add rcx, 2
cmp rcx, r10
jl 0x14009937c
lea rax, [0x14013f04c]
add rsp, 0x28
ret
mov edx, r9d
lea rcx, [0x140150e50]
add rsp, 0x28
jmp fcn.1400b15d0

Function at 0x14009991c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rbp + 7]
movabs rax, 0x20c49ba5e353f7cf
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x8888888888888889
mov qword [rbp - 1], rdx
imul rcx
add rdx, rcx
lea rcx, [rbp - 0x19]
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 9], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x19]
lea rcx, [rbp + 0x67]
mov qword [rbp - 0x11], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rbp + 0x67]
lea rcx, [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x67]
sub rcx, qword [rbp - 0x11]
mov rax, qword [rbp - 9]
cmp rcx, rax
jg 0x1400999e2
sub rax, rcx
cqo
idiv qword [rbp - 1]
test eax, eax
je 0x1400999e2
xor edx, edx
mov dword [rsp + 0x20], 0x1cff
mov r9d, eax
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0x102
jne 0x140099a24
call fcn.1400659bc
mov rax, qword [rbp - 9]
add qword [rbp - 0x11], rax
jmp 0x140099a24
cmp dword [rbp + 0x17], 0x12
je 0x140099acb
mov rcx, qword [0x1401722a0]
lea rdx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140099a24
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0xf]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400999f1
lea rcx, [rbp + 0x6f]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rbp + 0x6f]
xorps xmm1, xmm1
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x77]
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x140156958]
comisd xmm1, xmmword [0x140156970]
jbe 0x14009999a
mov rcx, qword [0x140175168]
test rcx, rcx
je 0x14009999a
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x14009999a
mov rcx, qword [0x1401722a0]
mov dl, 1
call fcn.140065754
lea rcx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rbp + 0x7f]
jmp 0x14009999a
mov eax, dword [rbp + 0x1f]
add rsp, 0x98
pop rbx
pop rbp
ret
Function at 0x140099ad8
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x2a0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, qword [0x140172298]
lea rcx, str.RelaunchMaybeElevatedFromTempDirectory___n
xor edx, edx
call fcn.1400b31d8
cmp byte [0x14017228e], 0
jne 0x140099bd5
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x224
call fcn.14012a960
lea rdx, [rsp + 0x60]
mov ecx, 0x112
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x110
jbe 0x140099b5f
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140099b5f
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call fcn.1400b2af0
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov r8, r14
mov r9, rax
mov ecx, 0xfde9
call fcn.1400be6d0
lea r8, str.Sumatra_Uninstaller.exe
mov rdx, rax
xor ecx, ecx
call fcn.1400b4220
mov rbx, rax
call fcn.1400b682c
mov rdi, rax
cmp rbx, rax
je 0x140099bb7
test rbx, rbx
je 0x140099c11
test rax, rax
je 0x140099c11
mov rdx, rax
mov rcx, rbx
call fcn.14010b2d0
test eax, eax
jne 0x140099c11
mov rax, qword [0x140172298]
cmp byte [rax + 0x14e], 0
jne 0x140099bff
lea rcx, str.__already_running_from_temp_dir_n
xor edx, edx
call fcn.1400b31d8
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call fcn.1400b70f0
test al, al
je 0x140099c11
lea rcx, str.__already_running_elevated_and_from_temp_dir_n
jmp 0x140099bce
mov r8, rbx
lea rcx, str.__copying_installer__s_to__s_n
mov rdx, rdi
call fcn.1400b3458
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1400b519c
test al, al
jne 0x140099c43
lea rcx, str.__failed_to_copy_installer_n
call fcn.1400b3458
jmp 0x140099bd5
lea rdx, str._uninstall
lea rcx, [rsp + 0x20]
call fcn.1400b181c
cmp byte [rsi + 0xa1], 0
je 0x140099c71
mov r8, r14
lea rdx, str.__silent
lea rcx, [rsp + 0x20]
call fcn.1400b18f8
cmp byte [rsi + 0x14d], 0
je 0x140099c8e
mov r8, r14
lea rdx, str.__log
lea rcx, [rsp + 0x20]
call fcn.1400b18f8
cmp byte [rsi + 0x14e], 0
je 0x140099cab
mov r8, r14
lea rdx, str.__all_users
lea rcx, [rsp + 0x20]
call fcn.1400b18f8
lea rcx, [rsp + 0x20]
call fcn.14003cc28
cmp byte [rsi + 0x14e], 0
mov rdi, rax
mov r8, rax
mov rdx, rbx
je 0x140099cfa
lea rcx, str.LaunchElevated__s___s__n
call fcn.1400b3458
mov rdx, rdi
mov rcx, rbx
call fcn.1400b7198
mov r8, rdi
mov rdx, rbx
test al, al
jne 0x140099cf1
lea rcx, str.LaunchElevated___failed_to_launch__s__s_n
jmp 0x140099d23
lea rcx, str.LaunchElevated___launched__s__s_ok__n
jmp 0x140099d38
lea rcx, str.LaunchProcessWithCmdLine__s__s__n
call fcn.1400b3458
mov rdx, rdi
mov rcx, rbx
call fcn.1400b6ed0
mov r8, rdi
mov rdx, rbx
test rax, rax
jne 0x140099d31
lea rcx, str.LaunchProcessWithCmdLine___failed_to_launch__s__s_n
call fcn.1400b3458
xor ecx, ecx
call fcn.1400b5d58
jmp 0x140099d3d
lea rcx, str.LaunchProcessWithCmdLine___launched__s__s_ok__n
call fcn.1400b3458
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140099d48
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edx, edx
lea rcx, str.InitSelfDelete___n
call fcn.1400b31d8
call fcn.1400b682c
and dword [rsp + 0x68], 0
lea rdx, str.timeout__t_2__nobreak__nul_r_n
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
and dword [rsp + 0x40], 0
mov rbx, rax
lea rax, [rsp + 0x48]
mov byte [rsp + 0x48], 0
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
mov r8, rsi
mov dword [rsp + 0x44], 1
call fcn.1400b18f8
mov r8, rbx
lea rdx, str.del___s__r_n
lea rcx, [rsp + 0x30]
call fcn.1400b1a70
mov r8, rsi
lea rdx, str._goto__2_nul__del___f0__r_n
lea rcx, [rsp + 0x30]
call fcn.1400b18f8
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x224
call fcn.14012a960
lea rdx, [rsp + 0x70]
mov ecx, 0x112
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x110
jbe 0x140099e2b
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140099e2b
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call fcn.1400b2af0
mov r9, rax
lea rdx, [rsp + 0x70]
mov r8, rsi
mov ecx, 0xfde9
call fcn.1400be6d0
xor r8d, r8d
lea rdx, str.sumatra_self_del.bat
mov rcx, rax
call fcn.1400b41a4
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
mov rbx, rax
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, rax
call fcn.1400b4dbc
mov rdx, rbx
test al, al
jne 0x140099e8f
lea rcx, str.Failed_to_write__s_n
call fcn.1400b3458
jmp 0x140099eba
lea rcx, str.Created_self_delete_batch_script__s_n
call fcn.1400b3458
mov rdx, rbx
lea rcx, str.cmd.exe__C___s_
call fcn.1400b2dac
xor edx, edx
mov r8d, 0x8000000
mov rcx, rax
call fcn.1400b6fbc
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140099ee8
lea rax, [rsp + 0x48]
cmp rdx, rax
je 0x140099ee8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140099ee2
mov rcx, rdx
call fcn.140107298
jmp 0x140099ee8
mov rax, qword [rcx]
call qword [rax + SafeArrayCopy]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret