joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433770
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2e], r8b
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0xa8], rdx
nop
xor ebx, ebx
mov rcx, qword [rbp + 0x20]
call fcn.00411370
mov rcx, rax
xor edx, edx
lea r8, [rbp + 0x5c]
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
setne sil
test sil, sil
je 0x433840
mov eax, dword [rbp + 0x5c]
test eax, 0x400
je 0x433840
movzx rax, byte [rbp + 0x2e]
test al, al
je 0x433840
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x50]
call fcn.00431340
test al, al
je 0x433840
mov rcx, qword [rbp + 0x50]
call fcn.00434330
test al, al
je 0x433823
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x20]
call fcn.00433f50
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.0043df60
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x50]
call fcn.004117d0
mov rcx, qword [rbp + 0x50]
call fcn.00411370
mov rcx, rax
xor edx, edx
lea r8, [rbp + 0x5c]
call sub.kernel32.dll_GetFileAttributesExW
test eax, eax
setne sil
test sil, sil
jne 0x43387a
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
sub eax, 0x20
cmp eax, 2
jae 0x43387a
mov rcx, qword [rbp + 0x20]
call fcn.00411370
mov rcx, rax
xor edx, edx
lea r8, [rbp + 0x5c]
call fcn.00433720
test eax, eax
jne 0x433878
mov ebx, 0x20
jmp 0x43387a
xor ebx, ebx
test ebx, ebx
jne 0x4338b1
mov eax, dword [rbp + 0x5c]
test eax, 0x10
jne 0x4338ac
lea rax, [rbp + 0x70]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0xa8]
call sub.kernel32.dll_FileTimeToLocalFileTime
test eax, eax
jne 0x4338b1
mov ebx, 0x20
jmp 0x4338b1
mov ebx, 0x20
test ebx, ebx
sete al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040fe40
lea rcx, [rbp + 0x50]
call fcn.0040fd60
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret

Function at 0x4339d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.00411370
mov rdi, rax
mov rcx, rdi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x433a77
mov ecx, eax
test ecx, 0x400
je 0x433a6c
test sil, sil
jne 0x433a0f
mov al, 1
jmp 0x433aa0
test eax, 0x10
je 0x433a1e
xor eax, eax
jmp 0x433aa0
mov rcx, rdi
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x433a5f
mov rcx, rax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x433aa0
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
sete al
jmp 0x433aa0
test eax, 0x10
sete al
jmp 0x433aa0
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x433a9a
cmp eax, 3
je 0x433a9a
cmp eax, 0x7b
je 0x433a9a
mov rcx, rbp
mov rdx, rbx
call fcn.00433980
test al, al
jne 0x433a9e
xor eax, eax
jmp 0x433aa0
mov al, 1
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x433ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov ebx, edx
xor esi, esi
call fcn.00411370
mov r13, rax
mov rcx, r13
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x433b91
mov eax, edi
test eax, 0x400
jne 0x433af2
test edi, 0x10
setne sil
jmp 0x433b91
test bl, bl
je 0x433b3f
mov rcx, r13
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x433b91
mov rcx, rax
call sub.kernel32.dll_CloseHandle
test edi, 0x10
setne sil
jmp 0x433b91
test edi, 0x10
je 0x433b4c
mov sil, 1
jmp 0x433b91
mov rcx, r13
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x433b8e
mov rcx, rax
call sub.kernel32.dll_CloseHandle
xor esi, esi
jmp 0x433b91
mov sil, 1
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x433d00
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rbx
call fcn.00411370
mov r13, rax
mov rcx, r13
call sub.kernel32.dll_DeleteFileW
test eax, eax
setne sil
test sil, sil
jne 0x433d6f
call sub.kernel32.dll_GetLastError
mov edi, eax
mov rcx, r13
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x433d68
mov ecx, eax
test ecx, 0x400
je 0x433d68
test eax, 0x10
je 0x433d68
mov rcx, rbx
call fcn.00411370
mov rcx, rax
call sub.kernel32.dll_RemoveDirectoryW
test eax, eax
setne sil
jmp 0x433d6f
mov ecx, edi
call sub.kernel32.dll_SetLastError
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x434460
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.00411370
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x43a990
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x43a9b6
movzx rax, word [rbp + 0x2c]
jmp 0x43a9b8
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x43c040
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.0043be00
mov ebx, eax
mov rax, qword [0x007dc3a0]
cmp byte [rax], 0
je 0x43c16f
mov rcx, qword [0x007dbb00]
call fcn.0040bc40
call fcn.00409430
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043c000]
mov r8d, 1
movsxd r9, esi
call fcn.00414220
mov ecx, 1
xor edx, edx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x0043c1fc]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x43c1b2
mov rcx, qword [0x007e3280]
call fcn.00414a00
mov rcx, rax
mov rax, qword [0x007db9c8]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW
xor ecx, ecx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x0043c000]
call fcn.004143f0
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret
Function at 0x43d810
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.00410410
lea rcx, [rbp + 0x48]
call fcn.00410650
mov rcx, qword [rbp + 0x48]
call fcn.00411370
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x43d8c1
mov ecx, dword [rbp + 0x44]
call fcn.004090f0
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.00411370
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43d8b7
mov rcx, qword [rbp + 0x58]
lea rdx, [0x0043d918]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43d8b7
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00409120
nop
lea rcx, [rbp + 0x48]
call fcn.0040fd60
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x43d920
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], r9
nop
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x80]
call fcn.00410410
lea rcx, [rbp + 0x58]
call fcn.00410650
mov rcx, qword [rbp + 0x58]
call fcn.00411370
mov rcx, rax
lea rdx, [rbp + 0x50]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x43da30
mov ecx, dword [rbp + 0x54]
call fcn.004090f0
mov qword [rbp + 0x68], rax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00411370
mov rcx, rax
mov edx, dword [rbp + 0x50]
mov r8d, dword [rbp + 0x54]
mov r9, qword [rbp + 0x68]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43da26
mov rcx, qword [rbp + 0x68]
lea rdx, [0x0043da88]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x44]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43da26
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x40], eax
mov rax, qword [rbp + 0x88]
mov ecx, dword [rbp + 0x40]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov rax, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x48]
movzx ecx, word [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x3c]
shr ecx, 0x10
movzx ecx, cx
mov dword [rax], ecx
mov byte [rbp + 0x67], 1
nop
mov rcx, qword [rbp + 0x68]
call fcn.00409120
nop
lea rcx, [rbp + 0x58]
call fcn.0040fd60
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x43f010
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.00410530
mov r13d, eax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.00418490
mov esi, eax
cmp esi, 0x104
jbe 0x43f06b
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.004090f0
mov rdi, rax
jmp 0x43f06f
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.00418490
mov rcx, rdi
call sub.user32.dll_CharUpperW
xor ebx, ebx
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x43f0c5
sub edx, ecx
add edx, 1
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movsxd rcx, eax
movzx ecx, word [rdi + rcx*2]
xor ebx, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x43f0a6
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x43f0d7
mov rcx, rdi
call fcn.00409120
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x4a7400
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov qword [rsp + 0x40], rcx
cmp qword [0x007e8eb0], 0
jne 0x4a74a6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc
mov rbx, rax
mov rax, qword [0x007e8ea8]
mov qword [rbx], rax
lea rcx, [0x007a3978]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.004095a0
lea rax, [0x004a73c0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.004a73f0
mov dword [rsi + 1], eax
mov rax, qword [0x007e8eb0]
mov qword [rsi + 5], rax
mov qword [0x007e8eb0], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x4a7464
mov qword [0x007e8ea8], rbx
mov rax, qword [0x007e8eb0]
mov rsi, qword [0x007e8eb0]
mov rcx, qword [rsi + 5]
mov qword [0x007e8eb0], rcx
mov rcx, qword [rsp + 0x40]
lea rdi, [rsi + 5]
mov rsi, rcx
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x54c770
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
xor r9, r9
sub edx, 1
mov ecx, r9d
cmp ecx, edx
jg 0x54c7b0
sub edx, r9d
add edx, 1
mov ecx, eax
and cx, 0xf800
movzx ecx, cx
shr ecx, 0xb
shl eax, 5
or cx, ax
mov eax, ecx
movzx cx, byte [r8]
xor ax, cx
add r8, 1
sub edx, 1
test edx, edx
jne 0x54c788
nop
ret
Function at 0x6bfb40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x159], 0
jne 0x6bfbde
cmp qword [0x007e9e30], 0
jne 0x6bfb85
call sub.kernel32.dll_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x007cc168]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007e9e30], rax
cmp qword [0x007e9e28], 0
jne 0x6bfba5
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007e9e28], rax
cmp qword [0x007e9e38], 0
jne 0x6bfbde
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x007cc160]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x007e9e38], rax
add rsp, 0x48
ret

Function at 0x6c0d40
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2d0]
test rax, rax
je 0x6c0e1f
cmp dword [rbx + 0x128], 0
jne 0x6c0e15
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006c0c40]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6c0e15
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6c0dc3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6c0e14
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.0048a200
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6c0dd4
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6c11c0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007e9df8]
cmp qword [rax + 0x2d0], 0
je 0x6c1384
test sil, sil
jne 0x6c12ac
cmp dword [rbx + 0x138], 0
jne 0x6c129d
mov rcx, rbx
call fcn.006c54a0
lea rcx, [0x006c1080]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6c125f
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x193], 0
je 0x6c125f
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6c1239
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c125e
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1241
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c129c
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.0048a200
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1270
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6c1384
cmp dword [rbx + 0x138], 0
jle 0x6c1384
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6c1384
cmp qword [rbx + 0xa8], 0
je 0x6c1323
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x193], 0
je 0x6c1323
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6c12fa
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c1322
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1302
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c1360
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.0048a200
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c1334
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006ab1b0]
call fcn.004143f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6c5890
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6c5a55
mov byte [rbx + 0x193], sil
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x6c59bd
mov rcx, rax
call fcn.00593030
test al, al
je 0x6c59bd
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6c59bd
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6c59bd
test sil, sil
je 0x6c593c
mov rcx, qword [rbx + 0x2d0]
xor edx, edx
xor r8, r8
call fcn.006afdc0
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006afdc0
jmp 0x6c59a6
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
xor edx, edx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006afdc0
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006afdc0
test dil, dil
je 0x6c59a6
mov rcx, qword [rbx + 0xa8]
call fcn.00592a80
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005867c0
test sil, sil
je 0x6c5a03
mov rcx, qword [rbx + 0x2d0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor edx, edx
call sub.user32.dll_SetWindowTextW
jmp 0x6c5a55
mov rcx, qword [rbx + 0x2d0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.00411370
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6fd880
Capabilities:
Query environment variable

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.00411370
mov r13, rax
mov rcx, r13
xor edx, edx
xor r8, r8
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov edi, eax
test edi, edi
jle 0x6fd8d2
mov rcx, rbx
mov edx, edi
sub edx, 1
call fcn.00411620
mov rcx, qword [rbx]
call fcn.00411370
mov rcx, r13
mov rdx, rax
mov r8d, edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
jmp 0x6fd8dd
mov rcx, rbx
mov rdx, rsi
call fcn.00410390
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x140ec9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140ec91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ec9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ec906f
add dl, dl
jne 0x140ec9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ec90f6
xor eax, eax
add dl, dl
jne 0x140ec90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ec91ad
add dl, dl
jne 0x140ec90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ec90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ec90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ec90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ec90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ec907e
mov eax, 1
add dl, dl
jne 0x140ec9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ec9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ec90fb
sub eax, ebx
mov ebx, 1
jne 0x140ec914c
mov ecx, 1
add dl, dl
jne 0x140ec912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ec913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ec9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ec907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ec9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ec9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ec915d
cmp eax, 0x7d00
jae 0x140ec919b
cmp eax, 0x500
jb 0x140ec9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ec907e
cmp eax, 0x7f
ja 0x140ec919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ec907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ec91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ec907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18001f37f
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800472f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x18007e0c5]
call fcn.180020662
mov qword [rbp + 8], 0
jmp 0x18004732e
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x180047384
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x180047323
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x18001fc71
Capabilities:
Terminate process

Disassembly:
jmp 0x18005a9f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret