joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012c3f0
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
mov qword [rbp + 0x10], rcx
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx + 8]
mov rcx, rax
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140004990
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_ResumeThread
mov esi, eax
lea rcx, [rbp - 0x70]
call fcn.1400049e0
nop
cmp byte [rbp - 0x40], 0
je 0x14012c45a
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
mov eax, esi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14012c8a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140004990
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002fc4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14012c960
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, rbx
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140004990
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp byte [rbp - 0x40], 0
je 0x14012ca10
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
call fcn.140002fc4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14012ca60
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rdi, rdx
mov ebx, r8d
mov rsi, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov r14, qword [rcx + 8]
mov qword [rbp - 0x48], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, rdi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
mov r9, rsi
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140004990
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012cb23
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
call fcn.140002fc4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14012cf50
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov esi, r8d
test rcx, rcx
je 0x14012cf83
add rcx, 0xc
mov rdi, rcx
jmp 0x14012cf85
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], rdx
mov rbx, rdx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rbx
mov qword [rbp - 0x5c], rdx
mov r8d, esi
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.140004990
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.140002fc4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14012dd80
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rdi, r8
mov rsi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rdi, rdi
jne 0x14012dde8
xor r8d, r8d
jmp 0x14012ddec
lea r8, [rdi + 0x10]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rsi
mov r9, rsi
test r14, r14
jne 0x14012de00
xor eax, eax
jmp 0x14012de04
lea rax, [r14 + 0x10]
mov qword [rbp - 0x58], rax
test r15, r15
jne 0x14012de12
xor r10d, r10d
jmp 0x14012de16
lea r10, [r15 + 0x10]
mov qword [rbp - 0x60], r10
test r12, r12
jne 0x14012de24
xor r11d, r11d
jmp 0x14012de29
lea r11, [r12 + 0x10]
mov qword [rbp - 0x68], r11
test r13, r13
jne 0x14012de36
xor esi, esi
jmp 0x14012de3a
lea rsi, [r13 + 0x10]
mov qword [rbp - 0x70], rsi
mov rcx, rdx
mov qword [rbp - 0x7c], rcx
mov edx, ebx
mov dword [rbp - 0x74], edx
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rsi
lea rcx, [rbp - 0xb8]
call fcn.140004990
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov esi, eax
lea rcx, [rbp - 0xb8]
call fcn.1400049e0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012ded6
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14012e010
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x68], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rdi, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rdi, rdi
jne 0x14012e076
xor r8d, r8d
jmp 0x14012e07a
lea r8, [rdi + 0x10]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rsi
mov r9, rsi
test r14, r14
jne 0x14012e08e
xor eax, eax
jmp 0x14012e092
lea rax, [r14 + 0x10]
mov qword [rbp - 0x58], rax
test r15, r15
jne 0x14012e0a0
xor r10d, r10d
jmp 0x14012e0a4
lea r10, [r15 + 0x10]
mov qword [rbp - 0x60], r10
test r12, r12
jne 0x14012e0b2
xor r11d, r11d
jmp 0x14012e0b7
lea r11, [r12 + 0x10]
mov qword [rbp - 0x68], r11
mov rsi, qword [rbp + 0x30]
mov rcx, rdx
mov qword [rbp - 0x74], rcx
mov edx, ebx
mov dword [rbp - 0x6c], edx
mov qword [rbp - 0x7c], r8
mov qword [rbp - 0x84], r9
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r11
lea rcx, [rbp - 0xb0]
call fcn.140004990
mov rcx, qword [rbp - 0x74]
mov edx, dword [rbp - 0x6c]
mov r8, qword [rbp - 0x7c]
mov r9, qword [rbp - 0x84]
call sub.ADVAPI32.dll_RegEnumValueW
mov esi, eax
lea rcx, [rbp - 0xb0]
call fcn.1400049e0
nop
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012e14b
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14012e410
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401082c0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x14012e461
add rsi, 0xc
jmp 0x14012e463
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.140004990
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.1400049e0
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14012e4dc
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140108350
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140145670
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov rsi, r9
mov rdi, qword [rbp + 0x40]
mov qword [rbp - 0x40], rcx
mov rbx, rcx
test rdx, rdx
je 0x1401456b8
add rdx, 0xc
mov r14, rdx
jmp 0x1401456bb
xor r14d, r14d
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x50], r8
mov r15, r8
mov qword [rbp - 0x58], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r12, qword [rbp + 0x30]
mov qword [rsp + 0x20], r12
mov r12d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x30], rdi
mov rcx, rbx
mov qword [rbp - 0x60], rcx
mov rdx, r14
mov qword [rbp - 0x68], rdx
mov r8, r15
mov qword [rbp - 0x70], r8
mov r9, rsi
mov qword [rbp - 0x78], r9
lea rcx, [rbp - 0xa0]
call fcn.140004990
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x78]
call sub.CRYPT32.dll_CryptProtectData
mov esi, eax
lea rcx, [rbp - 0xa0]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.140002fc4
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140145780
Capabilities:
Encrypt data using dpapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov rdi, r9
mov rbx, qword [rbp + 0x40]
mov qword [rbp - 0x40], rcx
mov r14, rcx
mov qword [rbp - 0x48], r8
mov r15, r8
mov qword [rbp - 0x50], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r12, qword [rbp + 0x30]
mov qword [rsp + 0x20], r12
mov r12d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov qword [rbp - 0x58], rcx
mov rdx, rsi
mov qword [rbp - 0x60], rdx
mov r8, r15
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140004990
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.CRYPT32.dll_CryptUnprotectData
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.1400049e0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test esi, esi
setne sil
movzx esi, sil
call fcn.140002fc4
mov dword [rax + 8], edi
movzx eax, sil
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140167810
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x140167824
mov edi, 0xd5313557
jmp 0x14016784b
mov ecx, edx
call fcn.140167740
mov rdx, rax
lea rcx, [0x14032ec10]
lea r8, [0x140331b08]
call fcn.1400805e0
mov rcx, rax
call fcn.1401676d0
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1401aace0
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1401aad1e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x1401aad03
xor r10d, r10d
jmp 0x1401aad07
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x1401aaceb
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1401ad7f0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.14000105f
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x1401b2600
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401b2634
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401b2616
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x1401b2650
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401b2684
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401b2666
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1409a1418
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409a159f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409a1449
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a142f
add dl, dl
jne 0x1409a1456
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a14b6
xor eax, eax
add dl, dl
jne 0x1409a1465
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a156d
add dl, dl
jne 0x1409a1476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a1483
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a1490
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a149d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409a14aa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409a143e
mov eax, 1
add dl, dl
jne 0x1409a14c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a14d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a14bb
sub eax, ebx
mov ebx, 1
jne 0x1409a150c
mov ecx, 1
add dl, dl
jne 0x1409a14ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409a14fb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a14e3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a143e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409a1528
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409a1535
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a151d
cmp eax, 0x7d00
jae 0x1409a155b
cmp eax, 0x500
jb 0x1409a1556
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a143e
cmp eax, 0x7f
ja 0x1409a155e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a143e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409a1592
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409a143e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180002d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
add eax, 0xf21
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
add eax, 0x2ba
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x3b37
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
add eax, 0x13e5
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x390
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x159e
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x83
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x2540
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x2540
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x710
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0xc03
cmp dword [rsp + 0x28], eax
je 0x180002e69
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
sub eax, 0x64c
mov dword [rsp + 0x24], eax
jmp 0x180002f08
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e85
mov eax, dword [rsp + 0x20]
add eax, 3
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002f08
mov eax, dword [rsp + 0x38]
sub eax, 0x1b76
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x28d2
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e7a
mov eax, dword [rsp + 0x2c]
sub eax, 0x2fe
add rsp, 0x68
ret
Function at 0x180004670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
add eax, 0x5ac
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
sub eax, 0x8e1
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x2d13
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x2d13
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x326b
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0x354
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x16b3
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0xf02
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
add eax, 0x11fd
cmp dword [rsp + 0x2c], eax
je 0x180004802
mov eax, dword [rsp + 0x24]
add eax, 0x785
cmp dword [rsp + 0x2c], eax
jge 0x180004750
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b0020]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
sub eax, 0x6c1
mov dword [rsp + 0x20], eax
jmp 0x180004802
mov eax, dword [rsp + 0x30]
or eax, 0x1b16
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x180004802
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004780
mov eax, dword [rsp + 0x28]
add eax, 4
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x180004802
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x15b2
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x180004775
mov eax, dword [rsp + 0x3c]
add eax, 0x5b0
add rsp, 0x68
ret