joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d230
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov byte [rsp + 0x20], 0
mov rax, qword [rsp + 0x70]
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140005dc0
jmp 0x14001d26d
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140005b20
mov rax, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140005e00
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140005a70
movzx eax, al
test eax, eax
je 0x14001d2ec
lea rcx, [rsp + 0x28]
call fcn.140005ad0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x70]
call fcn.14001d0e0
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140020d00
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14001d2dc
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
jmp 0x14001d25b
movzx eax, byte [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x140020d00
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x68a0
call fcn.140029ba0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14005bd60]
xor rax, rsp
mov qword [rsp + 0x6890], rax
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call fcn.140022670
nop
mov rax, qword [rsp + 0x68b0]
add rax, 8
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_7775]
movzx eax, al
test eax, eax
jne 0x140020dd7
xor eax, eax
mov word [rsp + 0x6680], ax
lea rax, [rsp + 0x6682]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x68b0]
add rax, 8
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov rdx, qword [rsp + 0x68c0]
lea rcx, [rsp + 0x6680]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x6680]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
jmp 0x140020ebf
mov rax, qword [rsp + 0x68b0]
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x140020e59
xor eax, eax
mov word [rsp + 0x6470], ax
lea rax, [rsp + 0x6472]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
lea rcx, [rsp + 0x41c8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov rdx, qword [rsp + 0x68c0]
lea rcx, [rsp + 0x6470]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x6470]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
jmp 0x140020ebf
xor eax, eax
mov word [rsp + 0x6260], ax
lea rax, [rsp + 0x6262]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_521
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x68b0]
mov rcx, rax
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x6260]
call qword [sym.imp.MSVCR120.dll_wcscpy_s]
lea rcx, [rsp + 0x6260]
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea rdx, [rsp + 0x6260]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1498]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x68b8]
call qword [sym.imp.mfc120u.dll_Ordinal_280]
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x40]
call fcn.1400227e0
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rax, qword [rsp + 0x68b8]
mov rcx, qword [rsp + 0x6890]
xor rcx, rsp
call fcn.140029b50
add rsp, 0x68a0
pop rdi
ret

Function at 0x140021530
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.1400216d0
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
add rsp, 0x38
ret
Function at 0x140021950
Capabilities:
Delete registry key

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov qword [rsp + 0x48], 0xfffffffffffffffe
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xb0]
call fcn.140021780
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [rsp + 0xb8], 0xffffffff
je 0x140021a56
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0xb8]
lea rcx, [rsp + 0x70]
call fcn.140021e80
lea rcx, [rsp + 0x50]
mov rdi, rcx
mov rsi, rax
mov ecx, InitCommonControls
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x80]
call fcn.140003b60
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140021fd0
mov r9d, 0x400
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140003770
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1636]
mov rcx, qword [rsp + 0x40]
mov r9, rcx
lea r8, [0x1400438e8]
mov rdx, rax
mov rcx, 0xffffffff80000001
call fcn.14000cf40
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x1400229f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x60]
call sub.mfc120u.dll_Ordinal_448
nop
mov rax, qword [rsp + 0x60]
add rax, 0x120
mov rcx, rax
call fcn.14001f590
mov rax, qword [rsp + 0x60]
lea rcx, vtable.CPCUHTMLDialog.1.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x60]
lea rcx, vtable.CPCUHTMLDialog.0
mov qword [rax + 0x120], rcx
mov rax, qword [rsp + 0x60]
add rax, reloc.mfc120u.dll_Ordinal_320
mov rcx, rax
call fcn.140026850
nop
mov rax, qword [rsp + 0x60]
add rax, 0x390
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140025c20
mov rax, qword [rsp + 0x60]
add rax, 0x3c0
mov edx, 0xa
mov rcx, rax
call sub.mfc120u.dll_Ordinal_543
nop
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x3a8], 0
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x3b0], 0
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x3b8], 0
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x3a0], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x130], rcx
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x3f8], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x138], rcx
mov rax, qword [rsp + 0x60]
mov dword [rax + Ordinal_1030], 0x26c
mov rax, qword [rsp + 0x60]
mov dword [rax + Ordinal_1036], 0x1f4
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
mov qword [rax + reloc.mfc120u.dll_Ordinal_1056], rcx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x428], rcx
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x430], 0x60
mov rax, qword [rsp + 0x60]
mov dword [rax + Ordinal_1086], 0x60
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x434], 0x60
mov rax, qword [rsp + 0x60]
mov dword [rax + Ordinal_1086], 0x60
mov rax, qword [rsp + 0x60]
mov byte [rax + Ordinal_1036], 1
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x410], 0
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x3fc], 0
mov rax, qword [rsp + 0x60]
mov qword [rax + reloc.mfc120u.dll_Ordinal_296], 0
mov rax, qword [rsp + 0x60]
cmp qword [rax + reloc.mfc120u.dll_Ordinal_1056], 0
je 0x140022c65
movzx eax, word [rsp + 0x78]
mov r8d, 5
mov edx, eax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + reloc.mfc120u.dll_Ordinal_1056]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140022c65
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + reloc.mfc120u.dll_Ordinal_1056]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + Ordinal_1053], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x418], 0
je 0x140022c65
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x418]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0xf0], rcx
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x140024cf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14005bd60]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x20], 0
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140024d38
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
test eax, eax
je 0x140024d36
mov byte [rsp + 0x20], 1
jmp 0x140024d52
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
test eax, eax
je 0x140024d52
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140024e52
xor r9d, r9d
mov r8d, 0xf012
mov edx, 0x112
mov rcx, qword [rsp + 0x70]
call fcn.140026020
call fcn.14002c680
cmp eax, 2
jne 0x140024e52
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x430]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x434]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x70]
add rax, 0x434
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x430
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x70]
call fcn.140005cb0
mov rcx, qword [rsp + 0x30]
mov r8, rcx
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call fcn.14002c520
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x28]
cmp dword [rax + 0x430], ecx
jne 0x140024e08
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x24]
cmp dword [rax + 0x434], ecx
je 0x140024e52
mov rcx, qword [rsp + 0x70]
call fcn.140025810
lea rcx, [rsp + 0x40]
call fcn.1400059c0
lea rcx, [rsp + 0x40]
call fcn.14001f590
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140025f40
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov dl, 1
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x390]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140029b50
add rsp, 0x68
ret
Function at 0x140027690
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call sub.mfc120u.dll_Ordinal_11776
test eax, eax
je 0x1400276c4
mov eax, 1
jmp 0x140027810
mov dword [rsp + 0x24], 0
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x20], ax
mov rax, qword [rsp + 0x68]
cmp dword [rax + 8], 0x100
jne 0x140027703
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x74
jne 0x140027703
mov dword [rsp + 0x24], 1
jmp 0x1400277fe
mov rax, qword [rsp + 0x68]
cmp dword [rax + 8], 0x100
jne 0x140027766
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x4f
je 0x140027741
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x50
je 0x140027741
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x4e
je 0x140027741
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0x4c
jne 0x140027766
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
cmp eax, 0x8000
jne 0x140027766
mov dword [rsp + 0x24], 1
jmp 0x1400277fe
mov rax, qword [rsp + 0x60]
add rax, 0x220
xor edx, edx
mov rcx, rax
call fcn.1400279f0
movzx eax, al
test eax, eax
je 0x1400277fe
mov rax, qword [rsp + 0x60]
add rax, 0x220
mov rcx, rax
call fcn.1400034a0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400278f0
nop
lea rcx, [rsp + 0x30]
call fcn.1400034a0
test rax, rax
je 0x1400277f4
lea rcx, [rsp + 0x30]
call fcn.1400034a0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x28]
test eax, eax
jne 0x1400277e4
mov dword [rsp + 0x28], 1
jmp 0x1400277ec
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.140027980
cmp dword [rsp + 0x24], 0
je 0x14002780c
mov eax, 1
jmp 0x140027810
mov eax, dword [rsp + 0x24]
add rsp, 0x58
ret
Function at 0x14002aa00
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x14002aa65
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14002aa65
mov eax, dword [rsp + 0x20]
and eax, 0xfffffffe
mov edx, eax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rsp + 0x34], 5
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.14002ca60
nop
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x38]
call fcn.140013c20
nop
mov rdx, qword [str.xmlnsurn:www.corel.com_ipm_dynamicmessages_xmlns:dmurn:www.corel.com_ipm_dynamicmessages_xmlns:wmurn:www.corel.com_ipm_workflowmessages]
lea rcx, [rsp + 0x58]
call fcn.140013c20
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xa8]
call fcn.14002beb0
nop
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rdx, qword [0x14005bdb0]
mov rcx, qword [rsp + 0x50]
call fcn.140013c20
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xf8]
call fcn.14001fc30
nop
lea r8, [rsp + 0xa8]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002c260
nop
lea rcx, [rsp + 0xa8]
call fcn.1400082a0
nop
lea rcx, [rsp + 0x58]
call fcn.140013de0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xc8]
call fcn.14002beb0
nop
mov rcx, qword [rsp + 0xf8]
call fcn.14001fc30
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.1400209f0
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0xc8]
call fcn.1400082a0
cmp dword [rsp + 0x28], 0
jl 0x14002abb1
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.14002ca60
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.14002bf90
nop
lea rcx, [rsp + 0x90]
call fcn.14002bf60
jmp 0x14002abec
mov dword [rsp + 0x2c], 4
lea rdx, [rsp + 0x2c]
lea rcx, [rsp + 0x80]
call fcn.14002ca60
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.14002bf90
nop
lea rcx, [rsp + 0x80]
call fcn.14002bf60
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xf0]
call fcn.14002be60
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x38]
call fcn.140013de0
nop
lea rcx, [rsp + 0x40]
call fcn.14002bf60
nop
mov rcx, qword [rsp + 0xf8]
call fcn.14002bf40
mov rax, qword [rsp + 0xf0]
add rsp, 0xe8
ret
Function at 0x14002c6f0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x14005bd60]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x14005e868]
test eax, eax
jne 0x14002c804
cmp qword [0x14005e860], 0
jne 0x14002c7fd
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.Shcore.DLL
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll_wcscat_s]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14005e860], rax
cmp qword [0x14005e860], 0
je 0x14002c7fd
lea rdx, str.GetDpiForMonitor
mov rcx, qword [0x14005e860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005e858], rax
lea rdx, str.GetProcessDpiAwareness
mov rcx, qword [0x14005e860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005e848], rax
lea rdx, str.SetProcessDpiAwareness
mov rcx, qword [0x14005e860]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005e850], rax
cmp qword [0x14005e848], 0
je 0x14002c7dc
cmp qword [0x14005e850], 0
je 0x14002c7dc
cmp qword [0x14005e858], 0
jne 0x14002c7fd
mov qword [0x14005e858], 0
mov qword [0x14005e848], 0
mov qword [0x14005e850], 0
mov byte [0x14005e868], 1
movzx eax, byte [0x14005e868]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140029b50
add rsp, 0x248
ret
Function at 0x140003190
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14000d980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
movd xmm1, r9d
shufps xmm1, xmm0, 0xe4
shufps xmm0, xmm1, 0x24
xorps xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
ret
Function at 0x140030da0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140030de2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140030dea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140030dfb
jmp 0x140030e12
xor r10d, r10d
jmp 0x140030e9d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140030e12
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140030e29
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140030e49
add r11, r8
jmp 0x140030f7a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140030f12
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140030ec0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140030f30
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140030f42
jmp 0x140030f5c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140030f5c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140030f76
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400e11a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rdx]
movzx eax, byte [rcx + 0x24]
cmp al, 2
je 0x1400e11e9
and al, 1
jne 0x1400e11e9
movzx eax, byte [rdi + 0x34]
xor al, 4
or al, byte [rdi + 0x35]
mov eax, dword [rdi + 0x30]
jne 0x1400e11ec
cmp eax, 0xff
ja 0x1400e11ec
test al, al
js 0x1400e1249
movzx eax, al
shl rax, 0x20
test al, 1
je 0x1400e11f8
jmp 0x1400e12d3
mov eax, dword [rdi + 0x30]
shl rax, 0x20
test al, 1
jne 0x1400e12d3
mov rcx, rax
shr rcx, 0x27
jne 0x1400e120d
shr rax, 0x20
mov byte [rsi + 8], al
jmp 0x1400e12d6
mov r14, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x1400e1284
js 0x1400e132b
movzx eax, byte [0x140473641]
mov edx, 1
mov rcx, rbx
call fcn.140020a00
mov r15, rax
test rax, rax
jne 0x1400e128a
mov ecx, 1
mov rdx, rbx
call fcn.140345060
cmp byte [rcx + 0x27], 0
je 0x1400e12c0
mov r14, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x1400e12ef
js 0x1400e132b
movzx eax, byte [0x140473641]
mov edx, 1
mov rcx, rbx
call fcn.140020a00
mov r15, rax
test rax, rax
jne 0x1400e12f5
jmp 0x1400e123c
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rbx
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
movups xmmword [rsi + 0x38], xmm2
mov byte [rsi + 0x48], 0
jmp 0x1400e12e3
movzx eax, al
shl rax, 8
or rax, 1
test al, 1
je 0x1400e11f8
mov byte [rsi + 8], ah
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rbx
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
movups xmmword [rsi + 0x38], xmm2
mov byte [rsi + 0x48], 1
jmp 0x1400e12e3
call fcn.1401ecdb0
int3