joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400efab0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x660
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov r12, qword [rsp + 0x6c0]
mov r14, rdx
mov r15, r8
lea rdx, [rsp + 0x230]
xor ebx, ebx
mov r8d, 0x104
movsxd rdi, r9d
mov rsi, rcx
mov ebp, ebx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x230]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400efb10
test rax, rax
je 0x1400efb60
lea rdx, str._s_d
lea rcx, [rsp + 0x440]
xor r9d, r9d
mov r8, r15
call fcn.1400f98c8
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x440]
mov r9, r12
mov rcx, r14
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rdi, rax
jge 0x1400efb7e
mov rax, rdi
jmp 0x1400efb92
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, ebx
cmp r8, rax
jge 0x1400efc17
lea r9, [rsp + 0x20]
mov edx, 0x148
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400efbb6
test rax, rax
je 0x1400efc10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
call fcn.1400f92fc
test eax, eax
je 0x1400efc10
lea rdx, str._s_d
lea rcx, [rsp + 0x440]
mov r9d, ebp
mov r8, r15
call fcn.1400f98c8
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x440]
mov r9, r12
mov rcx, r14
inc ebp
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc ebx
jmp 0x1400efb60
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x660
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f04d0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x8e0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov r15, qword [rsp + 0x938]
mov rbx, rcx
mov edi, r8d
mov rbp, rdx
lea rcx, [rsp + 0x4b0]
mov r8d, 0x410
xor edx, edx
mov r14, r9
call fcn.1400f9ab0
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x20], 0
jne 0x1400f053e
or eax, 0xffffffff
jmp 0x1400f074a
lea rdx, [0x140182ce0]
lea rcx, [rsp + 0xa0]
mov r8d, edi
mov qword [rsp + 0x8d8], rsi
call fcn.1400f98c8
lea rcx, [rsp + 0x4b0]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400f0570
lea r8, [rsp + 0xa0]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400f0590
lea rcx, [rsp + 0x4b0]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400f05b0
movsxd rsi, dword [rsp + 0x930]
mov eax, dword [0x14018675c]
xor edi, edi
mov dword [rcx], eax
mov ebx, edi
test rsi, rsi
jle 0x1400f0641
mov r8d, dword [r14 + rbx*4]
lea rdx, [0x140187948]
lea rcx, [rsp + 0xa0]
call fcn.1400f98c8
lea rcx, [rsp + 0x4b0]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1400f0600
lea r8, [rsp + 0xa0]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x1400f0620
inc rbx
cmp rbx, rsi
jl 0x1400f05d4
mov eax, dword [0x14018675c]
lea rcx, [rsp + 0x4b0]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1400f0650
movsxd rbx, dword [rsp + 0x940]
mov dword [rcx], eax
test rbx, rbx
jle 0x1400f06e1
mov esi, dword [rsp + 0x948]
mov r8, qword [r15 + rdi*8]
lea rcx, [rsp + 0xa0]
lea rdx, [0x14018fab8]
test esi, esi
jne 0x1400f068e
lea rdx, [0x14018fac8]
call fcn.1400f98c8
lea rax, [rsp + 0x4b0]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x1400f06a0
lea r8, [rsp + 0xa0]
xor edx, edx
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rax + rdx*2 - 2], cx
test cx, cx
jne 0x1400f06c0
inc rdi
cmp rdi, rbx
jl 0x1400f0670
mov eax, dword [0x14018675c]
mov rsi, qword [rsp + 0x8d8]
lea rdx, [rsp + 0x4b0]
sub rdx, 2
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1400f06f5
mov dword [rdx], eax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
lea rdx, str.Profile__s
call fcn.1400f98c8
lea r9, [0x140208860]
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400e4870
xor eax, eax
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x8e0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400f34d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebx, InitCommonControls
lea rdi, [rsp + 0x30]
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, al
jne 0x1400f351a
inc ebx
inc rdi
cmp ebx, 0x7b
jl 0x1400f3500
xor eax, eax
jmp 0x1400f351f
mov eax, 1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret

Function at 0x1400f55d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, edx
mov rdi, rcx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400f5734
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
mov rcx, rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x467
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
sub ebx, eax
mov eax, 0x66666667
imul ebx
mov ebx, edx
sar ebx, 2
mov ecx, ebx
shr ecx, 0x1f
add ebx, ecx
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f5650
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400f5673
mov eax, 0x66666667
imul ebx
mov ebx, edx
sar ebx, 2
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov esi, 1
mov edx, 0x808
mov rcx, rdi
cmp ebx, esi
cmovg esi, ebx
xor r9d, r9d
lea r8d, [r9 + 0x65]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4ca
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp bp, 1
jne 0x1400f56b3
add ebx, esi
jmp 0x1400f56ba
test bp, bp
jne 0x1400f56ba
sub ebx, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rsp + 0x38]
cmp ebx, eax
jle 0x1400f56ed
xor r9d, r9d
xor r8d, r8d
mov edx, 0x469
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test ebx, ebx
jns 0x1400f5707
xor r9d, r9d
xor r8d, r8d
mov edx, 0x467
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
movsxd r9, ebx
xor r8d, r8d
mov edx, 0x807
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x806
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f5970
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0xa0
mov ebp, r9d
mov rsi, rcx
mov r14d, r8d
lea r9, [0x140208860]
lea rcx, str.Viewing
lea rdx, str.Magnifier
movaps xmmword [rsp + 0x90], xmm6
movaps xmm6, xmm1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x1400f5aae
mov eax, dword [rsp + 0xd8]
mov rcx, qword [0x1401fbad8]
mov qword [rsp + 0xb0], rbx
movsd qword [rsp + 0x68], xmm6
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0xe0]
mov qword [rsp + 0xb8], rdi
mov edi, dword [rsp + 0xd0]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0xf0]
lea r9, [0x1400f35f0]
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x60]
mov r8, rsi
mov edx, 0x5a8
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x74], ebp
mov dword [rsp + 0x78], edi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov ecx, dword [rsp + 0x110]
mov r9d, dword [rsp + 0x100]
mov r8d, dword [rsp + 0xf8]
mov dword [rsp + 0x50], r14d
mov rdx, rsi
movsd qword [rsp + 0x48], xmm6
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x108]
mov rbx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rax
call fcn.1400f5b30
mov rdi, qword [rsp + 0xb8]
mov rax, rbx
mov rbx, qword [rsp + 0xb0]
jmp 0x1400f5ab0
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
ret

Function at 0x1400fa630
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fa646
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400fa648
xor eax, eax
test eax, eax
je 0x1400fa658
mov ecx, eax
call fcn.140104a80
or eax, 0xffffffff
jmp 0x1400fa65a
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401007a4
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401007bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401007be
xor eax, eax
test eax, eax
je 0x1401007ce
mov ecx, eax
call fcn.140104a80
or eax, 0xffffffff
jmp 0x1401007d0
xor eax, eax
add rsp, 0x28
ret

Function at 0x140106e74
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140106cdc
Function at 0x14011f2d0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x14011f303
call fcn.140123dc0
cmp byte [rbx + 0x58], 0
je 0x14011f2fc
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x14011f395
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x14011f37c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14011f32e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14011f374
cmp eax, 2
je 0x14011f37c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14011f320
dec eax
test eax, 0xfffffffd
jne 0x14011f320
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14011f320
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14011f320
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14011f3d0
cmp eax, 0xcc
je 0x14011f3b7
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x13
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14011f3d0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14011f3fe
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14011f4ad
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14011f47d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14011f44f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x208]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x14011f4d5
cmp eax, dword [rbx + 0x78]
jb 0x14011f430
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x14011f420
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x14011f4c0
Function at 0x14011f3d0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x14011f303
call fcn.140123dc0
cmp byte [rbx + 0x58], 0
je 0x14011f2fc
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x14011f395
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x14011f37c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14011f32e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14011f374
cmp eax, 2
je 0x14011f37c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14011f320
dec eax
test eax, 0xfffffffd
jne 0x14011f320
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14011f320
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14011f320
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14011f3d0
cmp eax, 0xcc
je 0x14011f3b7
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x13
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14011f3d0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14011f3fe
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14011f4ad
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14011f47d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14011f44f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x208]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x14011f4d5
cmp eax, dword [rbx + 0x78]
jb 0x14011f430
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x14011f420
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x14011f4c0
Function at 0x1401254a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rcx
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1401254e0
cmp word [rsp + rax*2 + 0x6e], 0x5c
je 0x140125513
lea rax, [rsp + 0x70]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140125500
mov ecx, dword [0x140181e84]
mov dword [rax], ecx
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x6c]
movzx r8d, word [rsp + 0x6a]
movzx r9d, word [rsp + 0x68]
movzx eax, word [rsp + 0x6e]
movzx r10d, word [rsp + 0x66]
movzx r11d, word [rsp + 0x62]
movzx ebx, word [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x70]
lea r8, str._siv__04d_02d_02d_02d_02d_02d_03d.tmp
mov edx, 0x200
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call fcn.1401255b0
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2d0
pop rdi
ret
Function at 0x140143080
Capabilities:
Get file size

Disassembly:
push rbx
push r14
sub rsp, 0x78
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov r14, rcx
lea rdx, [0x140188451]
mov rcx, rbx
call fcn.140146f40
mov r8d, eax
test eax, eax
je 0x1401430e2
cmp eax, 2
je 0x1401430db
cmp eax, 0x102
je 0x1401430db
cmp eax, 0x202
je 0x1401430d4
cmp eax, 0x302
je 0x1401430d4
xor eax, eax
jmp 0x140143265
mov ecx, 2
jmp 0x1401430e7
mov ecx, 4
jmp 0x1401430e7
mov ecx, 3
test r8d, r8d
mov edx, 1
mov eax, 0x80
cmove eax, edx
mov r9d, 0x80000000
mov edx, 0xc0000000
cmove edx, r9d
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0x60], r15
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8d, [r15 + 3]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140143143
xor eax, eax
jmp 0x140143258
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x70], rsi
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x20], r15
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
test eax, eax
jle 0x1401431b4
mov rcx, rsi
call fcn.1400fa250
mov rdi, rax
test rax, rax
je 0x14014327a
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
lea rcx, [rsp + 0x48]
sub rcx, rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x1401431d0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140143218
cmp qword [rsp + 0x40], 0x20000000
jl 0x140143218
lea rcx, [rsp + 0x48]
dec rcx
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140143204
movzx eax, word [0x1401bfff0]
mov word [rcx], ax
lea rdx, [0x140199d30]
test rdi, rdi
lea r8, [rsp + 0x48]
cmovne rdx, rdi
mov ecx, ebp
call fcn.140142fc0
mov rbx, rax
test rax, rax
jne 0x140143243
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400f97e8
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x78
pop r14
pop rbx
ret
jmp 0x14014324e
Function at 0x140002170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000226b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002273
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400022aa
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002280
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400022d5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x1400022fb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400022e0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a450
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a495
xor al, al
jmp 0x14000a4e2
cmp word [rbx], 0
je 0x14000a4ad
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a4a0
cmp word [rsp + 0x30], 0
je 0x14000a4db
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a503
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a4c0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b690
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000d6d0
int3
Function at 0x14000ad00
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001c700
sub rsp, rax
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002d520]
lea rsi, [0x14002f550]
mov rdi, rcx
test r11d, r11d
jne 0x14000ad79
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a510
test al, al
je 0x14000ae5f
lea rcx, [rsp + 0x20]
call fcn.1400110e8
movsxd r11, dword [0x14002d520]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002d520], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000adb4
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ada4
add rax, 2
test ecx, ecx
jne 0x14000ad90
test edx, edx
je 0x14000add7
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ad84
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000adc0
cmp rax, 2
jne 0x14000addb
cmp word [rdi + 2], 0x3a
jne 0x14000addb
mov al, 1
jmp 0x14000ae3e
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ae08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ae08
mov bl, 1
jmp 0x14000ae0c
test bl, bl
je 0x14000ae33
cmp dword [0x14002d520], 0x400
jge 0x14000ae33
mov rcx, rdi
call fcn.1400110e8
movsxd rdx, dword [0x14002d520]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002d520], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b690
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000ab50
int3