joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x14012d520], 0
jne 0x14002cb4d
lea rcx, [0x14002cd60]
call fcn.140044a20
mov qword [0x14012d520], rax
lea rcx, [0x14002cdc0]
call fcn.140044a20
mov qword [0x14012d528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.1400434f0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x14012d518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x14012d520]
mov rdx, rdi
call fcn.140044b00
cmp rdi, rax
je 0x14002cbab
mov rcx, rdi
call fcn.140043590
jmp 0x14002cbbb
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012d528]
call fcn.140044b00
mov rcx, qword [0x14012d520]
xor edx, edx
call fcn.140045270
cmp rax, rdi
jne 0x14002cbd6
mov ecx, dword [rdi + 0x10]
call fcn.140007000
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140030520
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov r14, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov edx, 0x107
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov rcx, rdi
call fcn.1400cffd0
mov word [rsp + rax + 0x50], 0x2a5c
mov byte [rsp + rax + 0x52], 0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x1400305c0
mov rdi, rax
lea rbx, [rsp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rcx, rbx
mov edx, 0x140
call r14
mov rcx, rdi
mov rdx, rbx
call rsi
test eax, eax
jne 0x1400305a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
mov edx, 4
call r14
lea rcx, [rsp + 0x30]
mov edx, 0x20
call fcn.1400303d0
test al, al
je 0x140030607
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, 0x20
call r14
mov edx, 0x20
mov rcx, rdi
call fcn.140078e50
mov rcx, r14
call fcn.14003d990
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140030630
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x78], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x78], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140030100
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x74]
mov ecx, 0xc
mov r8d, 4
call fcn.140030100
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140030100
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140030100
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140036f60
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.1400414f0
cmp byte [rax], 0
je 0x140036f84
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14004a3a0
mov rcx, rsi
mov edx, 0x3b
call fcn.1400412a0
test al, al
je 0x140036f9f
add rsp, 0x20
pop rsi
jmp fcn.14007a3e0
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14003d990
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x440
mov rsi, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x438], rax
mov ecx, 1
call fcn.14003da70
cmp rax, 0xffffffffffffffff
je 0x14003da45
mov rdi, rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003da3c
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14003da3c
lea rbx, [rsp + 0x30]
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax]
mov rcx, rbx
call rsi
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x400
mov r9, r14
call r15
test eax, eax
je 0x14003da3c
mov edx, dword [rsp + 0x2c]
test edx, edx
jne 0x14003da10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x438]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x440
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003dd20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 2
call fcn.14003da70
cmp rax, 0xffffffffffffffff
je 0x14003dd74
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003e210
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rcx
test edx, edx
je 0x14003e26f
xor eax, eax
xor ecx, ecx
cmp edx, 2
setne al
sete cl
lea r8d, [rax + rax*2]
mov eax, 0x40000000
mov edx, 0x80000000
cmove edx, eax
mov eax, ecx
shl eax, 7
xor ecx, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x30], 0
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
setne al
jmp 0x14003e2af
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14003e2a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14003e2a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140047ad0
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rdi
mov r8, rax
call fcn.1400071e0
mov qword [rsi], 0xffffffffffffffff
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400465c0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, edx
mov rbx, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0x105
mov edi, 0x105
mov ecx, 0x105
mov edx, 1
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea r14, [rsp + 0x38]
nop
mov rcx, rbx
mov edx, ebp
mov r8, rsi
mov r9d, edi
call r15
cmp eax, 0xea
jne 0x140046653
mov r9, qword [rsp + 0x38]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.1400435a0
mov rsi, rax
mov rdi, qword [rsp + 0x38]
jmp 0x140046610
test eax, eax
je 0x140046661
mov rcx, rsi
call fcn.140043590
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ba340
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140046680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
xor ecx, 4
or ecx, eax
mov eax, dword [rsp + 0x34]
xor eax, 4
or eax, ecx
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba340
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140046980
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [r8 + 0x10]
add eax, 1
mov r8, qword [r8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9d, 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x140046dd0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14012ddb0], 1
jne 0x140046de8
mov al, byte [0x14012ddb1]
jmp 0x140046f6e
mov byte [0x14012ddb0], 1
lea rcx, str.advapi32.dll
call fcn.1400462c0
mov qword [0x14012ddb8], rax
test rax, rax
je 0x140046f66
lea rdx, str.GetSecurityInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012ddc0], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f1f
lea rdx, str.SetSecurityInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012ddc8], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f2e
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012ddd0], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f3d
lea rdx, str.GetTokenInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012ddd8], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f4c
lea rdx, [0x140107046]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012dde0], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f5b
lea rdx, [0x140107376]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012dde8], rax
test rax, rax
je 0x140046f66
mov rcx, qword [0x14012ddb8]
test rcx, rcx
je 0x140046f73
lea rdx, str.SetEntriesInAclA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140046f75
mov qword [0x14012ddc8], 0
xor eax, eax
jmp 0x140046f68
mov qword [0x14012ddd0], 0
xor eax, eax
jmp 0x140046f68
mov qword [0x14012ddd8], 0
xor eax, eax
jmp 0x140046f68
mov qword [0x14012dde0], 0
xor eax, eax
jmp 0x140046f68
mov qword [0x14012dde8], 0
xor eax, eax
mov byte [0x14012ddb1], al
add rsp, 0x28
ret
xor eax, eax
mov qword [0x14012ddf0], rax
test rax, rax
setne al
jmp 0x140046f68
Function at 0x1400ba1d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rdx]
bswap r8
xor r8, qword [rcx + 0x70]
mov qword [rcx + 0x70], r8
mov r9, qword [rdx + 8]
bswap r9
xor r9, qword [rcx + 0x78]
pxor xmm0, xmm0
xor r10d, r10d
mov edx, r9d
and edx, 1
mov rax, r9
shr rax, 1
mov qword [rcx + 0x78], rax
neg rdx
movdqu xmm1, xmmword [rcx + r10 + 0x90]
movq xmm2, rdx
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and eax, 1
shr r9, 2
mov qword [rcx + 0x78], r9
neg rax
movdqu xmm1, xmmword [rcx + r10 + 0xa0]
movq xmm0, rax
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r10, 0x20
cmp r10, 0x400
jne 0x1400ba1f0
xor r9d, r9d
nop dword [rax]
mov eax, r8d
and eax, 1
mov rdx, r8
shr rdx, 1
mov qword [rcx + 0x70], rdx
neg rax
movdqu xmm1, xmmword [rcx + r9 + 0x490]
movq xmm2, rax
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and edx, 1
shr r8, 2
mov qword [rcx + 0x70], r8
neg rdx
movdqu xmm1, xmmword [rcx + r9 + 0x4a0]
movq xmm0, rdx
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r9, 0x20
cmp r9, 0x400
jne 0x1400ba260
movdqu xmmword [rcx + 0x70], xmm0
ret

Function at 0x1400c7bd4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c7d28
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400c7d97
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c7d97
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c7d97
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c7d97
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c7d97
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c7d97
cmp dword [rcx + 0xf8], 0
je 0x1400c7d97
mov ecx, ebx
call fcn.1400c7c54
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400c7ebc
nop
cmp dword [rbp + 0x20], 0
je 0x1400c7de5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400c7cf4
int3
Function at 0x1400cffd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400cffed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400d0048
test al, 7
jne 0x1400cffe0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400d0001
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400d0072
test dh, dh
je 0x1400d006c
shr rdx, 0x10
test dl, dl
je 0x1400d0066
test dh, dh
je 0x1400d0060
shr rdx, 0x10
test dl, dl
je 0x1400d005a
test dh, dh
je 0x1400d0054
shr edx, 0x10
test dl, dl
je 0x1400d004e
test dh, dh
jne 0x1400d0001
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x14019a000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.14019a0d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x14019a037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14019a02d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x14019a0cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x14019a0cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x14019a0ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x14019a081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x14019a072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x14019a021
Function at 0x1400014a6
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140031c50
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x140031c79
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140031cc3
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140031c6e
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140001eba
Capabilities:
Read clipboard data

Disassembly:
jmp 0x140007dc0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140007e55
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140001c58
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call fcn.14000233d
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x38]
call fcn.1400014dd
mov rax, qword [rsp + 0x90]
jmp 0x140007e7c
movzx edx, byte [0x140067e17]
mov rcx, qword [rsp + 0x90]
call fcn.140001edd
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x90]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400628d0]
call fcn.140002658
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001d25
add rsp, 0x80
pop rdi
ret

Function at 0x140001f23
Capabilities:
Terminate process

Disassembly:
jmp 0x140058150
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140002162
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400517a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400517dd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140002b49
add rsp, 0x58
ret
Function at 0x140002298
Capabilities:
Parse pe header

Disassembly:
jmp 0x140057510
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140057530
xor al, al
jmp 0x1400575b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140057543
xor al, al
jmp 0x1400575b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14005756d
xor al, al
jmp 0x1400575b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140057581
xor al, al
jmp 0x1400575b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140057593
xor al, al
jmp 0x1400575b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400575af
xor al, al
jmp 0x1400575b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140007dc0
Capabilities:
Read clipboard data

Disassembly:
jmp 0x140007dc0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140007e55
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140001c58
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
call fcn.14000233d
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x38]
call fcn.1400014dd
mov rax, qword [rsp + 0x90]
jmp 0x140007e7c
movzx edx, byte [0x140067e17]
mov rcx, qword [rsp + 0x90]
call fcn.140001edd
mov eax, dword [rsp + 0x70]
or eax, 1
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x90]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400628d0]
call fcn.140002658
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001d25
add rsp, 0x80
pop rdi
ret
Function at 0x140031c50
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140031c50
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x140031c79
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140031cc3
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140031c6e
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret

Function at 0x1400517a0
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400517a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400517dd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140002b49
add rsp, 0x58
ret
Function at 0x140001000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140001020
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.LauncherITP2Launcher.jar
call fcn.140001000
test eax, eax
je 0x140001083
lea rcx, str.LauncherJavaBinJavaw.exe
call fcn.140001000
test eax, eax
je 0x140001083
mov dword [rsp + 0x28], 9
lea r9, str._jar_LauncherITP2Launcher.jar
lea r8, str.LauncherJavaBinJavaw.exe
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140001968
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019b4
xor al, al
add rsp, 0x28
ret