joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018eed0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140204218], 0
je 0x14018ef16
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401249d0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1402041f0]
test rdi, rdi
je 0x14018efb7
test byte [reloc.WS2_32.dll_accept], 1
je 0x14018eef9
cmp byte [rdi + 0x17], 0
jns 0x14018ef38
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140204218], rax
inc rax
cmp rax, 1
ja 0x14018eef9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140127960
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x14018f07c
xor esi, esi
jmp 0x14018eef9
mov ecx, SafeArrayCopy
call fcn.140123e20
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140127960
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1401bc9e0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14015f270
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14018f01d
and eax, 0x7f
mov rcx, rdi
jmp 0x14018f024
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
je 0x14018f05b
add rax, rax
test rax, rax
je 0x14018f05b
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x14018f02c
cmp rdx, 0xfffffffffffffffe
je 0x14018f05b
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.1400d3d20
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.14007cce0
mov qword [0x1402041f0], rdi
jmp 0x14018ef26
mov rdi, qword [0x1402041f0]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.140146754
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14007cb80
mov rcx, qword [0x1402041f0]
call fcn.140182e40
cmp word [rax], 0x5c
je 0x14018f0c9
mov rcx, qword [0x1402041f0]
lea rdx, [0x1401c6976]
mov r8d, 1
call fcn.14007cce0
mov rcx, qword [0x1402041f0]
lea rdx, str.debug.log
mov r8d, 9
call fcn.14007cce0
mov rcx, qword [0x1402041f0]
cmp byte [rcx + 0x17], 0
jns 0x14018f0f2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140204218], rax
inc rax
cmp rax, 1
ja 0x14018eef9
mov qword [0x140204218], 0
jmp 0x14018efb0
Function at 0x140192470
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401bc9e0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PinShortcutToTaskbar
lea r8, str.....operadesktopchrome_importschromeinstallerutil_taskbar_util.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x7e
call fcn.1400ef4d0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e24f0
call fcn.140081fb0
cmp eax, 0xd
jl 0x140192576
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov rcx, rdi
call fcn.14009e0d0
cmp qword [rdi], 0
je 0x140192572
cmp byte [rsi + 0x17], 0
jns 0x140192510
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rdi, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
mov r8, rdi
mov r9d, 4
call qword [0x140215008]
test eax, eax
setns sil
test rdi, rdi
je 0x140192550
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1401925ad
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140215008]
jmp 0x1401925ad
xor esi, esi
jmp 0x1401925ad
cmp byte [rsi + 0x17], 0
jns 0x14019257f
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x21
setge sil
lea rcx, [rsp + 0x50]
call fcn.1400e2730
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401249d0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140199e00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140199e61
test r12, r12
je 0x140199f78
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401249d0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140199ec6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x140199eaf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401272b0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x140199e2e
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x140199fa4
lea rcx, [r15*8]
call fcn.140123e20
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x140199f43
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140199f78
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x140199f2b
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.14019a310
mov r12, qword [rsi + 0x10]
jmp 0x140199e2e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14016a900
call fcn.14015f3e0
int3
Function at 0x140199fb0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14019a00f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x14019a120
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401249d0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14019a06a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x14019a059
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401272b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x140199fde
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14019a14c
lea rcx, [r12*8]
call fcn.140123e20
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14019a0eb
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14019a120
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14019a0d3
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.14019a310
mov r15, qword [rsi + 8]
jmp 0x140199fde
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14016a900
call fcn.14015f3e0
int3
Function at 0x14019a160
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14019a1bf
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x14019a2d0
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401249d0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14019a21a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x14019a209
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401272b0
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14019a18e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14019a2fc
lea rcx, [r12*8]
call fcn.140123e20
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14019a29b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14019a2d0
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14019a283
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.14019a310
mov r15, qword [rsi + 8]
jmp 0x14019a18e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14016a900
call fcn.14015f3e0
int3

Function at 0x14019adb0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14019adca
xor edx, edx
mov r8d, 1
add rsp, 0x28
jmp fcn.1400d9970
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14016a900
int3
Function at 0x18002c8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x3b0
lea rbp, [rsp + 0x40]
mov rax, qword [0x18004b008]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov esi, r8d
mov word [rbp + 0x22], 0x5446
mov rdi, rdx
mov word [rbp + 0x28], 0x5c
mov rbx, rcx
mov word [rbp + 0x25], 0x5241
xor edx, edx
mov word [rbp + 0x20], 0x4f53
mov r8d, 0x104
mov byte [rbp + 0x27], 0x45
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x24], 0x57
mov r14d, r9d
mov dword [rbp + 0x10], 0x73257325
mov byte [rbp + 0x14], 0
call fcn.180030440
lea rcx, str.RSpeedupTab
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18002c960
inc eax
cmp eax, 0x3fffffff
jle 0x18002c977
xor eax, eax
jmp 0x18002c9b2
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18002c993
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18003e5e0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x40]
call fcn.18002c660
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.18002c600
lea rax, [rbp + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000001
call fcn.18002a910
test eax, eax
jne 0x18002cabf
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180030440
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x18], 0x7668
call fcn.18002a230
test eax, eax
jne 0x18002cab6
cmp dword [rbp + 4], eax
jbe 0x18002cab6
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180030440
lea r9, [rbp]
mov word [rbp], 0x6425
or r8, 0xffffffffffffffff
mov byte [rbp + 2], 0
mov edx, 0x104
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.18002c600
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.18002ba30
test rax, rax
je 0x18002cab6
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov eax, 1
jmp 0x18002caef
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov eax, dword [rbp + 0x3d0]
mov r9d, r14d
mov dword [rsp + 0x30], eax
mov r8d, esi
mov eax, dword [rbp + 0x3c8]
mov rdx, rdi
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov eax, dword [rbp + 0x3c0]
mov dword [rsp + 0x20], eax
call qword [0x180077aa0]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.18002e780
lea rsp, [rbp + 0x370]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18002cb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov rax, qword [0x18004b008]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x21], 0x5754464f
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x25], 0x5c455241
xor edx, edx
mov byte [rbp + 0x20], 0x53
mov r8d, 0x104
mov byte [rbp + 0x29], 0
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180030440
lea rcx, str.RSpeedupTab
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18002cb80
inc eax
cmp eax, 0x3fffffff
jle 0x18002cb97
xor eax, eax
jmp 0x18002cbd2
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18002cbb3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18003e5e0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18002c660
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.18002c600
lea rax, [rbp + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000001
call fcn.18002a910
test eax, eax
jne 0x18002cce6
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180030440
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov word [rbp + 0x1b], 0x736c
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x18], 0x7668
mov byte [rbp + 0x1d], 0
mov byte [rbp + 0x1a], 0x61
call fcn.18002a230
test eax, eax
jne 0x18002ccdd
cmp dword [rbp + 4], eax
jbe 0x18002ccdd
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180030440
lea r9, [rbp]
mov word [rbp], 0x6425
or r8, 0xffffffffffffffff
mov byte [rbp + 2], 0
mov edx, 0x104
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.18002c600
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.18002ba30
test rax, rax
je 0x18002ccdd
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov eax, 1
jmp 0x18002ccef
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov rcx, rbx
call qword [0x180077a20]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.18002e780
mov rbx, qword [rbp + 0x388]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18002cd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov rax, qword [0x18004b008]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov dword [rbp + 0x22], 0x41575446
lea rcx, [rbp + 0x30]
mov word [rbp + 0x20], 0x4f53
xor edx, edx
mov dword [rbp + 0x26], 0x5c4552
mov r8d, 0x104
mov word [rbp + 0x10], 0x7325
mov word [rbp + 0x13], 0x73
mov byte [rbp + 0x12], 0x25
call fcn.180030440
lea rcx, str.RSpeedupTab
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18002cd80
inc eax
cmp eax, 0x3fffffff
jle 0x18002cd97
xor eax, eax
jmp 0x18002cdd2
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18002cdb3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18003e5e0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18002c660
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.18002c600
lea rax, [rbp + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000001
call fcn.18002a910
test eax, eax
jne 0x18002cedd
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180030440
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x18], 0x7668
call fcn.18002a230
test eax, eax
jne 0x18002ced4
cmp dword [rbp + 4], eax
jbe 0x18002ced4
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180030440
lea r9, [rbp]
mov word [rbp], 0x6425
or r8, 0xffffffffffffffff
mov byte [rbp + 2], 0
mov edx, 0x104
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.18002c600
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.18002ba30
test rax, rax
je 0x18002ced4
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov rax, rbx
jmp 0x18002cee6
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov rcx, rbx
call qword [0x180077a58]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.18002e780
mov rbx, qword [rbp + 0x388]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18002cf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x388], rbx
mov rax, qword [0x18004b008]
xor rax, rbp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov word [rbp + 0x20], 0x4f53
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x25], 0x5c455241
xor edx, edx
mov byte [rbp + 0x29], 0
mov r8d, 0x104
mov word [rbp + 0x23], 0x5754
mov byte [rbp + 0x22], 0x46
mov dword [rbp + 0x11], 0x732573
mov byte [rbp + 0x10], 0x25
call fcn.180030440
lea rcx, str.RSpeedupTab
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18002cf80
inc eax
cmp eax, 0x3fffffff
jle 0x18002cf97
xor eax, eax
jmp 0x18002cfd2
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18002cfb3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18003e5e0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.18002c660
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x20]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.18002c600
lea rax, [rbp + 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000001
call fcn.18002a910
test eax, eax
jne 0x18002d0df
xor edx, edx
lea rcx, [rbp + 0x250]
mov r8d, 0x104
call fcn.180030440
mov rcx, qword [rbp + 8]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x18]
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1a], 0x736c61
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x18], 0x7668
call fcn.18002a230
test eax, eax
jne 0x18002d0d6
cmp dword [rbp + 4], eax
jbe 0x18002d0d6
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call fcn.180030440
lea r9, [rbp]
mov word [rbp], 0x6425
or r8, 0xffffffffffffffff
mov byte [rbp + 2], 0
mov edx, 0x104
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x140]
call fcn.18002c600
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x250]
call fcn.18002ba30
test rax, rax
je 0x18002d0d6
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov eax, 1
jmp 0x18002d0e8
mov rcx, qword [rbp + 8]
call fcn.18002aab0
mov rcx, rbx
call qword [0x180077a48]
mov rcx, qword [rbp + 0x360]
xor rcx, rbp
call fcn.18002e780
mov rbx, qword [rbp + 0x388]
lea rsp, [rbp + 0x370]
pop rbp
ret
Function at 0x18002d110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x18004b008]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x18002d1ee
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.18002a770
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.180033314
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.18002ba30
test rax, rax
jne 0x18002d222
lea rdx, [sym.gphelper.dll_xtwomt]
lea rcx, [0x180077aa0]
call fcn.18002e1f0
test eax, eax
je 0x18002d222
lea rdx, [sym.gphelper.dll_i3eg0w]
lea rcx, [0x180077a20]
call fcn.18002e1f0
test eax, eax
je 0x18002d222
lea rdx, [sym.gphelper.dll_quftqg]
lea rcx, [0x180077a58]
call fcn.18002e1f0
test eax, eax
je 0x18002d222
lea rdx, [sym.gphelper.dll_oce88s]
lea rcx, [0x180077a48]
call fcn.18002e1f0
jmp 0x18002d222
test edx, edx
jne 0x18002d222
lea rcx, [0x180077aa0]
call fcn.18002e610
lea rcx, [0x180077a20]
call fcn.18002e610
lea rcx, [0x180077a58]
call fcn.18002e610
lea rcx, [0x180077a48]
call fcn.18002e610
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18002e780
add rsp, 0x158
ret
Function at 0x140003988
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x1400039ff
movsxd rdx, ecx
lea rcx, [0x1400038e4]
call qword [sym.imp.USER32.DLL_EnumWindows]
mov rbx, qword [0x140011f98]
test rbx, rbx
je 0x140003a72
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x1400039f5
cmp byte [rbx + 0x20], 0
je 0x1400039f5
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.DLL_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x1400039bb
jmp 0x140003a72
mov rbx, qword [0x140011f98]
test rbx, rbx
je 0x140003a72
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140003a6a
cmp byte [rbx + 0x21], 0
je 0x140003a2e
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140003a5a
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.DLL_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140011f98]
call fcn.140006620
mov rbx, rdi
test rdi, rdi
jne 0x140003a0b
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140003c24
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rcx, rcx
je 0x140003c44
test rax, rax
lea rdx, [0x14000d999]
cmovne rdx, rax
call qword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
add rsp, 0x28
ret