joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007ae0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi
Log keystrokes via application hook

Disassembly:
sub rsp, 0x258
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ecx, 0x2000
call sym.dcapi.dll_secure_alloc
mov qword [0x180039a18], rax
test rax, rax
jne 0x180007b2c
mov eax, 9
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180015920
add rsp, 0x258
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea rdx, [0x180007720]
lea ecx, [r8 + 7]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x180039a08], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
lea ecx, [r8 + 2]
lea rdx, [0x180007810]
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
lea rcx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
mov qword [0x180039a20], rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x180007bb6
lea r9d, [rax + 1]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180007be7
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, 0x200
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea rcx, [rsp + 0x40]
mov edx, 0x200
call fcn.180007570
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call sym.dcapi.dll_rnd_reseed_now
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180015920
add rsp, 0x258
ret
Function at 0x180016c43
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180038240]
jne 0x18001593a
rol rcx, 0x10
test cx, 0xffff
jne 0x180015936
repz ret
ror rcx, 0x10
jmp 0x180016b9c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180039af0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180039be8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180016c21
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180039af0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180016c43
mov rax, qword [rsp + 0x88]
mov qword [0x180039be8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180039b88], rax
mov rax, qword [0x180039be8]
mov qword [0x180039a60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180039b70], rax
mov dword [0x180039a50], 0xc0000409
mov dword [0x180039a54], 1
mov rax, qword [0x180038240]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180038248]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180039ae8], eax
mov ecx, 1
call fcn.18001b83c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18002ad38]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180039ae8], 0
jne 0x180016cca
mov ecx, 1
call fcn.18001b83c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18001d9d4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180038240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800178ac
xor ebx, ebx
cmp qword [0x18003aa28], rbx
mov rdi, rax
jne 0x18001dae7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18001dbbe
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001dbbe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x18002c660]
mov rcx, rsi
mov qword [0x18003aa28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x18002c648]
mov rcx, rsi
mov qword [0x18003aa30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18003aa38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18003aa48], rax
test rax, rax
je 0x18001dade
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18003aa40], rax
jmp 0x18001daee
mov rax, qword [0x18003aa40]
jmp 0x18001daf5
mov rax, qword [0x18003aa40]
mov r11, qword [0x18003aa48]
cmp rax, rdi
je 0x18001db5c
cmp r11, rdi
je 0x18001db5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18003aa48]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18001db5c
test rax, rax
je 0x18001db5c
call rsi
test rax, rax
je 0x18001db56
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001db56
test byte [rsp + 0x40], 1
jne 0x18001db5c
bts ebp, 0x15
jmp 0x18001db9c
mov rcx, qword [0x18003aa30]
cmp rcx, rdi
je 0x18001db9c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001db9c
call rax
mov rbx, rax
test rax, rax
je 0x18001db9c
mov rcx, qword [0x18003aa38]
cmp rcx, rdi
je 0x18001db9c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001db9c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18003aa28]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001dbbe
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18001dbc0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180015920
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180027d30
Capabilities:
Hash data using sha512

Disassembly:
xor eax, eax
mov dword [rcx + 0x48], eax
mov qword [rcx + 0x40], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
ret
Function at 0x180028560
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r8d, 0xffffffff
mov r9, rcx
test edx, edx
je 0x1800285a0
mov r10d, edx
lea r11, [0x180032170]
nop word [rax + rax]
movzx edx, byte [r9]
movzx eax, r8b
mov ecx, r8d
xor rdx, rax
shr ecx, 8
inc r9
mov r8d, dword [r11 + rdx*4]
xor r8d, ecx
dec r10
jne 0x180028580
not r8d
mov eax, r8d
ret

Function at 0x1800285b0
Capabilities:
Encrypt data using aes via x86 extensions
Reference processor manufacturer constants

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 1
mov eax, r8d
xor ecx, ecx
cpuid
mov dword [rsp + 0x10], eax
mov dword [rsp + 0x14], ebx
mov dword [rsp + 0x1c], edx
bt ecx, 0x19
jae 0x1800285da
mov eax, r8d
jmp 0x180028650
test ecx, ecx
jns 0x18002864e
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x10], eax
cmp ebx, 0x7263694d
jne 0x18002864e
cmp ecx, 0x666f736f
jne 0x18002864e
cmp edx, 0x76482074
jne 0x18002864e
movdqa xmm0, xmmword [0x180032570]
aesenc xmm0, xmmword [0x180032580]
movdqa xmmword [rsp + 0x10], xmm0
movabs rax, 0x5f77774d4b7b7b54
cmp qword [rsp + 0x10], rax
jne 0x18002863c
movabs rax, 0x63636367427c7c58
cmp qword [rsp + 0x18], rax
je 0x18002863f
xor r8d, r8d
mov dword [rsp], r8d
jmp 0x1800285d5
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180028b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov rbp, r8
mov rdi, rdx
mov r13, rcx
shr r9, 9
mov qword [rsp + 0x28], 0
lea r15, [rax + 0x1670]
lea r14, [rax + 0x1e0]
nop dword [rax + rax]
inc r9
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8, r15
mov qword [rsp + 0x20], r9
call fcn.180014870
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12d, 0x20
nop word [rax + rax]
mov rax, qword [r13]
mov r8, r14
mov rdx, rdi
xor rax, rbx
mov rcx, rdi
mov qword [rdi], rax
mov rax, qword [r13 + 8]
xor rax, rsi
mov qword [rdi + 8], rax
call fcn.180015030
xor qword [rdi], rbx
xor qword [rdi + 8], rsi
mov rdx, rsi
mov rcx, rbx
shr rdx, 0x3f
shr rcx, 0x3f
lea rax, [rsi + rsi]
add rbx, rbx
mov rsi, rcx
add r13, 0x10
imul rdx, rdx, 0x87
xor rbx, rdx
add rdi, 0x10
or rsi, rax
dec r12
jne 0x180028c00
sub rbp, 0x200
je 0x180028c6f
mov r9, qword [rsp + 0x20]
jmp 0x180028bd0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180028ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov rbp, r8
mov rdi, rdx
mov r13, rcx
shr r9, 9
mov qword [rsp + 0x28], 0
lea r15, [rax + 0x1670]
lea r14, [rax + 0x1e0]
nop dword [rax + rax]
inc r9
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8, r15
mov qword [rsp + 0x20], r9
call fcn.180014870
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r12d, 0x20
nop word [rax + rax]
mov rax, qword [r13]
mov r8, r14
mov rdx, rdi
xor rax, rbx
mov rcx, rdi
mov qword [rdi], rax
mov rax, qword [r13 + 8]
xor rax, rsi
mov qword [rdi + 8], rax
call fcn.180014870
xor qword [rdi], rbx
xor qword [rdi + 8], rsi
mov rdx, rsi
mov rcx, rbx
shr rdx, 0x3f
shr rcx, 0x3f
lea rax, [rsi + rsi]
add rbx, rbx
mov rsi, rcx
add r13, 0x10
imul rdx, rdx, 0x87
xor rbx, rdx
add rdi, 0x10
or rsi, rax
dec r12
jne 0x180028d20
sub rbp, 0x200
je 0x180028d8f
mov r9, qword [rsp + 0x20]
jmp 0x180028cf0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180029590
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov r12, rdx
lea rdx, [rsp + 0x20]
mov rbx, rcx
call fcn.1800283b0
lea rcx, [rbx + 0xd4]
mov eax, 0x10
nop word [rax + rax]
xor dword [rcx - 4], 0x6a6a6a6a
xor dword [rcx], 0x6a6a6a6a
add rcx, 8
dec rax
jne 0x1800295d0
movabs rax, 0x6a09e667f3bcc908
xor r13d, r13d
mov esi, 0x80
mov qword [rbx], rax
movabs rax, 0xbb67ae8584caa73b
mov dword [rbx + 0x48], r13d
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x40], r13
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
lea rbp, [rbx + 0xd0]
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
nop dword [rax]
mov ecx, dword [rbx + 0x48]
test ecx, ecx
jne 0x18002969d
cmp rsi, 0x80
jb 0x18002969d
mov rdx, rbp
mov rcx, rbx
call fcn.180027db0
add qword [rbx + 0x40], 0x400
sub rbp, 0xffffffffffffff80
add rsi, 0xffffffffffffff80
jmp 0x1800296e8
mov eax, dword [rbx + 0x48]
mov edi, 0x80
mov rdx, rbp
sub edi, ecx
lea rcx, [rax + rbx + 0x4c]
cmp rdi, rsi
cmova rdi, rsi
mov r8, rdi
call fcn.180016100
add dword [rbx + 0x48], edi
add rbp, rdi
sub rsi, rdi
cmp dword [rbx + 0x48], 0x80
jne 0x1800296e8
lea rdx, [rbx + 0x4c]
mov rcx, rbx
call fcn.180027db0
add qword [rbx + 0x40], 0x400
mov dword [rbx + 0x48], r13d
test rsi, rsi
jne 0x180029670
mov esi, 0x40
lea rbp, [rsp + 0x20]
mov ecx, dword [rbx + 0x48]
test ecx, ecx
jne 0x180029724
cmp rsi, 0x80
jb 0x180029724
mov rdx, rbp
mov rcx, rbx
call fcn.180027db0
add qword [rbx + 0x40], 0x400
sub rbp, 0xffffffffffffff80
add rsi, 0xffffffffffffff80
jmp 0x18002976f
mov eax, dword [rbx + 0x48]
mov edi, 0x80
mov rdx, rbp
sub edi, ecx
lea rcx, [rax + rbx + 0x4c]
cmp rdi, rsi
cmova rdi, rsi
mov r8, rdi
call fcn.180016100
add dword [rbx + 0x48], edi
add rbp, rdi
sub rsi, rdi
cmp dword [rbx + 0x48], 0x80
jne 0x18002976f
lea rdx, [rbx + 0x4c]
mov rcx, rbx
call fcn.180027db0
add qword [rbx + 0x40], 0x400
mov dword [rbx + 0x48], r13d
test rsi, rsi
jne 0x1800296f7
mov rdx, r12
mov rcx, rbx
call fcn.1800283b0
lea r11, [rsp + 0x60]
lea rdi, [rsp + 0x20]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
xor eax, eax
mov ecx, 0x10
rep stosd dword [rdi], eax
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1800297c0
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [rcx + 0xd0]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.180015950
xor r12d, r12d
movabs rax, 0xa54ff53a5f1d36f1
movabs rcx, 0x510e527fade682d1
movabs rdx, 0x9b05688c2b3e6c1f
movabs r13, 0x6a09e667f3bcc908
movabs r14, 0xbb67ae8584caa73b
movabs r15, 0x3c6ef372fe94f82b
movabs r8, 0x1f83d9abfb41bd6b
movabs r9, 0x5be0cd19137e2179
cmp rbx, 0x80
jbe 0x18002989a
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rdx
mov qword [rdi + 0x30], r8
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
mov dword [rdi + 0x48], r12d
mov qword [rdi + 0x40], r12
mov qword [rdi], r13
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x38], r9
call fcn.180028490
mov rdx, rbp
mov rcx, rdi
call fcn.1800283b0
jmp 0x1800298a8
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.180016100
lea rax, [rdi + 0xd4]
mov ecx, 0x10
nop word [rax + rax]
xor dword [rax - 4], 0x36363636
xor dword [rax], 0x36363636
add rax, 8
dec rcx
jne 0x1800298c0
movabs rax, 0xa54ff53a5f1d36f1
mov dword [rdi + 0x48], r12d
mov qword [rdi + 0x40], r12
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi], r13
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 8], r14
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov esi, 0x80
mov qword [rdi + 0x38], rax
mov ecx, dword [rdi + 0x48]
test ecx, ecx
jne 0x180029961
cmp rsi, 0x80
jb 0x180029961
mov rdx, rbp
mov rcx, rdi
call fcn.180027db0
add qword [rdi + 0x40], 0x400
sub rbp, 0xffffffffffffff80
add rsi, 0xffffffffffffff80
jmp 0x1800299ac
mov eax, dword [rdi + 0x48]
mov ebx, 0x80
mov rdx, rbp
sub ebx, ecx
lea rcx, [rax + rdi + 0x4c]
cmp rbx, rsi
cmova rbx, rsi
mov r8, rbx
call fcn.180016100
add dword [rdi + 0x48], ebx
add rbp, rbx
sub rsi, rbx
cmp dword [rdi + 0x48], 0x80
jne 0x1800299ac
lea rdx, [rdi + 0x4c]
mov rcx, rdi
call fcn.180027db0
add qword [rdi + 0x40], 0x400
mov dword [rdi + 0x48], r12d
test rsi, rsi
jne 0x180029934
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14011fee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1401200f6
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14011ffa4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14011ff60
mov ecx, dword [r10]
jmp 0x140120087
cmp ecx, 0x4e0
jb 0x140120087
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14011ffc0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140120010
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14011ff40
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14011ff30
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14012011a
cmp r8, r14
jne 0x14011ff10
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x140149220
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QFileInfo::absolutePath_void____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::destructor_void____ptr64]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140161ba0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140161bdd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140161df0
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140161cdc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140161df0
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140161c50
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140006c10
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x140161d1b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140161d1b
call fcn.14015ca80
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140161d02
mov rcx, r14
call fcn.14015ca80
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret