joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011b090
Capabilities:
Get file size

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.180053100
nop
lea rcx, [rsp + 0x48]
call fcn.180044660
xor ebp, ebp
test al, al
jne 0x18011b0e1
xor dil, dil
jmp 0x18011b1d3
mov qword [rsp + 0x30], rbp
mov ecx, 8
call fcn.18017df38
mov qword [rsp + 0x40], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov r9d, 1
mov r8d, 0x80000000
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.18005b2a0
mov rbx, qword [rsp + 0x30]
test al, al
je 0x18011b1a3
mov rdi, rbp
test rbx, rbx
je 0x18011b1a3
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
jne 0x18011b14b
xor sil, sil
jmp 0x18011b17a
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18011b16c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18011b16c
xor sil, sil
jmp 0x18011b17a
mov edi, dword [rsp + 0x40]
shl rdi, 0x20
add rdi, rsi
mov sil, 1
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x18011b194
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18011b194
mov qword [rbx], 0xffffffffffffffff
test sil, sil
je 0x18011b1a3
test rdi, rdi
je 0x18011b1a3
mov dil, 1
jmp 0x18011b1a6
xor dil, dil
test rbx, rbx
je 0x18011b1d3
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18011b1c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
mov edx, 8
mov rcx, rbx
call fcn.18017df04
mov qword [rsp + 0x30], rbp
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18011b218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18011b213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18011b213
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18017dee0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18012a698
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x430
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r14, rdx
call fcn.18012b268
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180125008
nop
call fcn.18012b270
mov rdi, rax
mov rcx, rax
call fcn.180125b04
xor ebx, ebx
lea rcx, [rsp + 0x40]
test al, al
je 0x18012a730
mov rdx, r14
call fcn.180125334
lea rcx, [rsp + 0x40]
call fcn.1800b6970
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18012a86c
mov dil, 1
jmp 0x18012a869
mov rdx, rdi
call fcn.18012530c
call fcn.18012b5a4
test al, al
je 0x18012a74b
call fcn.18012b278
mov rsi, rax
jmp 0x18012a7a2
call fcn.18012b280
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.180125008
nop
lea rcx, [rbp + 0x60]
call fcn.1800b6970
mov rcx, rax
xor edx, edx
call fcn.1801311c0
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.1800b6970
mov rcx, rax
mov rdx, rdi
call fcn.180154f90
mov rsi, rax
test rdi, rdi
je 0x18012a799
mov rcx, rdi
call fcn.18017df04
nop
lea rcx, [rbp + 0x60]
call fcn.180125164
test rsi, rsi
jne 0x18012a7af
mov dil, bl
jmp 0x18012a869
mov dword [rsp + 0x30], ebx
or r8d, 0xffffffff
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.180125038
nop
lea r8, [0x1801bc5e4]
lea rdx, [0x1801b1a1c]
lea rcx, [rbp - 0x30]
call fcn.180125d84
lea rcx, [rbp - 0x30]
call fcn.1800b6970
mov rdx, rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov dil, 1
mov r8b, dil
mov rcx, rsi
call fcn.180154990
test eax, eax
jne 0x18012a85d
mov r15d, dword [rbp + 0x31c]
lea eax, [r15 - 1]
cmp eax, 0x3fffff
ja 0x18012a85d
mov ecx, r15d
call fcn.18017e210
mov r14, rax
mov r9d, r15d
mov r8, rax
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call fcn.18015548c
test eax, eax
je 0x18012a8a4
cmp eax, 0x600
je 0x18012a8a4
mov rcx, r14
call fcn.18017df04
call fcn.18012b5a4
test al, al
jne 0x18012a85d
mov rcx, rsi
call fcn.1801546d0
mov dil, bl
lea rcx, [rbp - 0x30]
call fcn.180125164
mov bl, dil
lea rcx, [rsp + 0x40]
call fcn.180125164
mov al, bl
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.18017dee0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18012b5a4
nop
test al, al
jne 0x18012a8b6
mov rcx, rsi
call fcn.1801546d0
mov rcx, r14
call fcn.18017df04
jmp 0x18012a860
Function at 0x18012b728
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rdi + 8]
mov ebx, edi
test ax, ax
cmovs ebx, ecx
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18012b759
or ebx, 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18012b76c
or ebx, 2
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18012b77f
or ebx, 4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18012b792
or ebx, 0x20
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18012ec3c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea r15, [rcx + 0x530]
mov rbx, rcx
xor r13d, r13d
mov rcx, r15
mov r12, r9
mov r14, r8
mov edi, edx
mov esi, r13d
call fcn.180125864
test eax, eax
jle 0x18012ecbb
mov edx, esi
mov byte [rbp + 0x30], r13b
mov rcx, r15
call fcn.1801252a8
lea rcx, [rbp + 0x30]
mov r9, r12
mov qword [rsp + 0x20], rcx
mov r8, r14
mov edx, edi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rbp + 0x30], r13b
jne 0x18012ed24
mov rcx, r15
inc esi
call fcn.180125864
cmp esi, eax
jl 0x18012ec7f
sub edi, 0x100
je 0x18012ed9d
sub edi, 4
je 0x18012ed28
cmp edi, 2
jne 0x18012ed7d
mov ecx, r14d
mov dword [rbp + 0x30], r13d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov rcx, qword [rbx + 0x160]
lea r8, [rbp + 0x30]
mov word [rbp + 0x30], ax
lea rdx, [0x180130fdc]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x258]
mov rbx, rax
test rax, rax
je 0x18012ed7d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x240]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov al, 1
jmp 0x18012ed7f
cmp qword [rbx + 0x168], r13
je 0x18012ed7d
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x190]
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x30], 6
mov word [rbp - 0x14], r14w
call fcn.18012b728
mov word [rbp - 0x12], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x168]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r14, 9
jne 0x18012ed7d
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x18012ee05
mov rax, qword [rcx]
call qword [rax + 0x1f0]
test al, al
je 0x18012ee05
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x208]
test al, al
je 0x18012ee05
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, str.RichEditUI
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x18012ee05
mov rcx, qword [rbx + 0x168]
call fcn.18015c464
test al, al
jne 0x18012ed7d
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x18012ee57
mov rax, qword [rcx]
call qword [rax + 0x1f0]
test al, al
je 0x18012ee57
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x208]
test al, al
je 0x18012ee57
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
lea rdx, str.WkeWebkitUI
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x18012ed7d
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.180130880
jmp 0x18012ed24
Function at 0x18013046c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0xc8]
cmp rax, rcx
je 0x18013049d
cmp rbx, qword [rdi + 0x168]
je 0x18013049d
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rdi + 0x168]
cmp rbx, rax
je 0x1801305bc
test rax, rax
je 0x18013051a
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x17
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
mov rdx, qword [rdi + 0x168]
lea r8, str.killfocus
xor r9d, r9d
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.18012fefc
and qword [rdi + 0x168], 0
test rbx, rbx
je 0x1801305bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp rax, rdi
jne 0x1801305bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1f0]
test al, al
je 0x1801305bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x208]
test al, al
je 0x1801305bc
xor edx, edx
mov qword [rdi + 0x168], rbx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x270]
mov rdx, qword [rdi + 0x168]
lea r8, str.setfocus
mov byte [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rcx, rdi
call fcn.18012fefc
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180134b7c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rcx
call fcn.1800b6a30
mov rcx, rax
mov edi, 0xfffffff0
mov edx, edi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
and ebx, 0xff3fffff
or ebx, 0x6000000
mov rcx, rsi
call fcn.1800b6a30
mov rcx, rax
mov r8d, ebx
mov edx, edi
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea r14, [rsi + 0x58]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.18012b2f8
mov rax, rsi
lea rcx, [rsi + 0x40]
neg rax
sbb rdx, rdx
and rdx, rcx
mov rcx, r14
call fcn.18012a410
lea rcx, [rbp + 0xf0]
call fcn.1801356ec
nop
mov rax, qword [rsi]
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [rax + 0x50]
nop
lea rcx, [rbp - 0x30]
call fcn.180125b04
lea rdx, [rsp + 0x40]
mov rcx, rsi
test al, al
mov rax, qword [rsi]
jne 0x180134cb5
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.1800b6970
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
movzx ebx, ax
lea rcx, [rsp + 0x40]
call fcn.180125164
mov rax, rsi
lea rcx, [rsi + 0x48]
neg rax
sbb rdi, rdi
and rdi, rcx
lea rcx, [rbp - 0x30]
call fcn.1800b6970
mov r8, rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9, rdi
mov edx, ebx
lea rcx, [rbp + 0xf0]
call fcn.1801367bc
mov rbx, rax
jmp 0x180134cfb
call qword [rax + 0x58]
nop
mov rcx, rax
call fcn.1800b6970
mov rcx, rsi
lea rdx, [rsi + 0x48]
neg rcx
sbb r9, r9
and r9, rdx
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1801367bc
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.180125164
test rbx, rbx
jne 0x180134d65
or r8d, 0xffffffff
lea rdx, [0x18019a9d0]
lea rcx, [rsp + 0x40]
call fcn.180125038
nop
mov rax, qword [rsi]
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [rax + 0x58]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18012530c
nop
lea rcx, [rbp + 0x60]
call fcn.180125164
lea rcx, [rsp + 0x40]
call fcn.1800b6970
mov rdx, rax
lea r9d, [rbx + 0x10]
lea r8, str.Duilib
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
mov rcx, r14
call fcn.18012a4f0
mov rax, rsi
lea r8, [rsi + 0x38]
neg rax
sbb rdx, rdx
and rdx, r8
mov rcx, r14
call fcn.18012a32c
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + gethostname]
nop
lea rcx, [rbp - 0x30]
call fcn.180125164
nop
lea rcx, [rbp + 0xf0]
call fcn.18013ab48
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.18017dee0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1801367bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r12, r9
shr rax, 0x10
mov r14, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x18013680d
cmp word [rdx], 0x3c
je 0x18013680d
call fcn.18001d550
mov rcx, rax
mov rdx, rbx
call fcn.180140700
test rax, rax
cmovne rbx, rax
mov rax, rbx
shr rax, 0x10
test ax, ax
je 0x18013685b
cmp word [rbx], 0x3c
mov rdx, rbx
mov rcx, rdi
jne 0x18013682c
call fcn.18013ae2c
jmp 0x180136834
xor r8d, r8d
call fcn.18013ae9c
test al, al
jne 0x1801368ec
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbp, qword [rdi + 0x158]
test rbp, rbp
jne 0x18013686f
call fcn.18012b254
mov rbp, rax
mov r8, r14
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x18013683c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x1801368a5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x18013683c
mov rdx, rsi
mov qword [rdi + 0x148], r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.18013b1e8
test al, al
je 0x18013683c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], r14
mov r9, qword [rsp + 0x78]
mov rdx, r12
mov r8, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18013571c
jmp 0x18013683e
Function at 0x180138020
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x728
jmp method.DuiLib::CMenuUI.virtual_632
Function at 0x180150604
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r11d, eax
mov ecx, eax
and r11d, 7
je 0x18015063d
cmp eax, r11d
jge 0x18015062f
mov rcx, rbx
call fcn.18014b4d0
mov eax, dword [rbx + 0x10]
mov ecx, r11d
shr dword [rbx + 0x14], cl
sub eax, r11d
mov dword [rbx + 0x10], eax
mov ecx, eax
xor edx, edx
test eax, eax
jle 0x18015066b
mov r8d, dword [rbx + 0x14]
lea r9, [rsp + 0x30]
mov al, byte [rbx + 0x14]
inc edx
mov byte [r9], al
inc r9
lea eax, [rcx - 8]
shr r8d, 8
mov dword [rbx + 0x14], r8d
mov ecx, eax
test eax, eax
jg 0x18015064c
mov dword [rbx + 0x10], eax
jns 0x18015067e
lea rcx, str.zlib_corrupt
call fcn.18014b3cc
jmp 0x180150723
movsxd rax, edx
cmp rax, 4
jge 0x1801506a9
mov rcx, qword [rbx]
cmp rcx, qword [rbx + 8]
jb 0x180150694
xor dl, dl
jmp 0x18015069c
mov dl, byte [rcx]
inc rcx
mov qword [rbx], rcx
mov byte [rsp + rax + 0x30], dl
inc rax
cmp rax, 4
jl 0x18015068a
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x18015066d
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1801506ee
lea rcx, str.read_past_buffer
jmp 0x180150674
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180150708
mov rcx, rbx
call fcn.180154208
test eax, eax
je 0x180150723
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180154770
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1801547b4
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1801547b4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rdi]
test ax, ax
je 0x180154867
mov rcx, rdi
mov rdx, rdi
cmp ax, 0x2f
je 0x1801547d2
cmp ax, 0x5c
jne 0x1801547d5
mov rcx, rdx
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x1801547c6
cmp rcx, rdi
je 0x180154824
sub rcx, rdi
mov rdx, rdi
sar rcx, 1
lea rsi, [rcx + rcx]
mov r8, rsi
lea rcx, [rsp + 0x230]
call sub.VCRUNTIME140.dll_memcpy
cmp rsi, 0x208
jae 0x18015488a
lea rdx, [rsp + 0x230]
mov word [rsp + rsi + 0x230], bp
mov rcx, rbx
call fcn.180154770
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x18015483c
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180154867
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18017dee0
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
call fcn.18017e07c
int3

Function at 0x180154ea8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r14d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x180154f78
cmp dword [rcx + 8], 0xffffffff
jne 0x180154f78
lea rdi, [rcx + 0x250]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
movzx ecx, word [rbx + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x180154f1c
cmp cx, 0x2f
je 0x180154f1c
lea rdx, [0x1801b1a1c]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov r9d, 1
cmp esi, r9d
jne 0x180154f41
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180154f41
mov eax, 0x2000000
jmp 0x180154f7d
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r14d
mov rcx, rbp
call fcn.180157828
test rax, rax
jne 0x180154f5f
mov eax, dword [rsp + 0x40]
jmp 0x180154f7d
mov rcx, rax
call fcn.180158048
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x180154f7d
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1801554dc
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
mov r10, rcx
movsx rax, dl
mov r8d, r9d
xor r8, rax
shr r9d, 8
movzx eax, r8b
lea r8, [0x18019eab0]
mov edx, dword [r8 + rax*4]
xor edx, r9d
mov dword [rcx], edx
movzx eax, dl
add eax, dword [rcx + 4]
mov edx, dword [r10 + 8]
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [r10 + 8], eax
ret

Function at 0x180157960
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
imul r8d, edx
mov rdi, r9
cmp byte [r9], 0
mov rsi, rdx
mov r10, rcx
je 0x1801579a7
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
mov rdx, rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1801579a1
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1801579d3
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
lea eax, [rdx + r8]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r8d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180157b28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x180157b41
xor eax, eax
jmp 0x180157bb2
lea rdi, [0x18019eab0]
not r9d
cmp r8d, 8
jb 0x180157b87
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x180157b5d
add r8d, 0xfffffff8
sub r11, 1
jne 0x180157b58
test r8d, r8d
je 0x180157bac
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r8d, 0xffffffff
jne 0x180157b8c
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x18015e71c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x708], r14
je 0x18015e7ca
cmp edx, 0x100
jne 0x18015e7a4
cmp di, 0xd
jne 0x18015e7a4
cmp byte [rcx + 0x712], r14b
je 0x18015e77b
lea ecx, [r14 + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18015e7a4
cmp byte [rbx + 0x713], r14b
jne 0x18015e7a4
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x18015e7a0
mov byte [rsp + 0x28], r14b
lea r8, str.return
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, rbx
call fcn.18012fefc
xor eax, eax
jmp 0x18015e7cf
mov rax, qword [rbx + 0x708]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + 0x18]
jmp 0x18015e7cf
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18015fa5c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x728
jmp method.DuiLib::CTreeViewUI.virtual_632