joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422bc0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x0048f5c8]
test rbx, rbx
je 0x422bf0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x0048f5c8]
test rax, rax
je 0x422c14
cmp dword [rax], 0xffffffff
je 0x422c35
add rsp, 0x20
pop rbx
ret
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov rbx, rax
mov qword [0x0048f5c8], rax
jmp 0x422bd1
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov qword [0x0048f5c8], rax
jmp 0x422be5
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]

Function at 0x4230d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x0048f5d0]
test rcx, rcx
je 0x423210
call fcn.00423040
mov rax, qword [0x0048f5c8]
test rax, rax
je 0x423233
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x423113
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00422a10
test rax, rax
mov rbx, rax
je 0x42327b
cmp qword [0x00492050], 0
je 0x42327b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x423282
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x0048f5c8]
test rax, rax
je 0x423257
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x423282
mov rax, rbx
jmp 0x42310a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00427da0
mov rcx, rax
mov qword [0x0048f5d0], rax
jmp 0x4230e8
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov qword [0x0048f5c8], rax
jmp 0x4230fd
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov qword [0x0048f5c8], rax
jmp 0x4231f8
xor eax, eax
jmp 0x42310a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00427da0
Function at 0x423290
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x0048f5d0]
test rcx, rcx
je 0x423210
call fcn.00423040
mov rax, qword [0x0048f5c8]
test rax, rax
je 0x423233
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x423113
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00422a10
test rax, rax
mov rbx, rax
je 0x42327b
cmp qword [0x00492050], 0
je 0x42327b
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x423282
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x0048f5c8]
test rax, rax
je 0x423257
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x423282
mov rax, rbx
jmp 0x42310a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00427da0
mov rcx, rax
mov qword [0x0048f5d0], rax
jmp 0x4230e8
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov qword [0x0048f5c8], rax
jmp 0x4230fd
lea r8, [0x00422050]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00427da0
mov qword [0x0048f5c8], rax
jmp 0x4231f8
xor eax, eax
jmp 0x42310a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00427da0
Function at 0x426040
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x0048f618]
mov esi, edx
test rcx, rcx
je 0x425fe0
call fcn.00428160
cmp dword [rbx], 0xbab1f00d
jne 0x426007
mov eax, dword [rbx + 4]
test eax, eax
jle 0x426007
mov eax, dword [rbx + 4]
test eax, eax
jle 0x425f93
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x0048f618]
test rcx, rcx
je 0x425fb0
call fcn.00428210
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x00425d20]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00427da0
mov rcx, rax
mov qword [0x0048f618], rax
call fcn.00428210
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x00425d20]
mov edx, 8
call fcn.00427da0
mov rcx, rax
mov qword [0x0048f618], rax
jmp 0x425f67
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x00479c60]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x00425d20]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00427da0
Function at 0x427da0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00417fb0
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x427e89
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x427f22
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x427ec4
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x427eb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x427f1f
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.00427d20
cmp rax, rbx
mov rsi, rax
je 0x427f39
mov rcx, rbx
call fcn.00421e50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.00427d20
mov rsi, rax
jmp 0x427ef9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x427ef9
mov rcx, rbx
call r13
jmp 0x427ef9

Function at 0x429c20
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x004619b0]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.00417df0

Function at 0x429c40
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x004619c0]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.00417df0
Function at 0x140420800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push rbp
push rax
push rcx
push rdx
lea rcx, section.UPX1
mov rdx, rcx
mov rsi, 0x10
mov al, byte [rdx]
xor al, 0x3c
mov byte [rdx], al
inc rdx
mov al, byte [rdx]
xor al, 0xe8
mov byte [rdx], al
inc rdx
dec rsi
jne 0x140420818
mov rsi, rcx
lea rdx, [rcx - 0x37d000]
mov rdi, rdx
pop rdx
pop rcx
pop rax
lea rax, [rdi + 0x401874]
push qword [rax]
mov dword [rax], 0x6e74baa6
push rax
push rdi
xor ebx, ebx
xor ecx, ecx
or rbp, 0xffffffffffffffff
jmp loc.140422818
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14065b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14065b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14065b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065b06f
add dl, dl
jne 0x14065b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065b0f6
xor eax, eax
add dl, dl
jne 0x14065b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065b1ad
add dl, dl
jne 0x14065b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14065b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14065b07e
mov eax, 1
add dl, dl
jne 0x14065b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065b0fb
sub eax, ebx
mov ebx, 1
jne 0x14065b14c
mov ecx, 1
add dl, dl
jne 0x14065b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14065b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065b15d
cmp eax, 0x7d00
jae 0x14065b19b
cmp eax, 0x500
jb 0x14065b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065b07e
cmp eax, 0x7f
ja 0x14065b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14065b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14065b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x41c990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x41c9ea
call fcn.0041f2e8
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x41c9ea
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x41ca0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0041c410
test rdi, rdi
mov esi, eax
je 0x41ca0a
test rbx, rbx
je 0x41ca0a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x427637
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0044cf98]
jne 0x423cea
rol rcx, 0x10
test cx, 0xffff
jne 0x423ce6
repz ret
ror rcx, 0x10
jmp 0x427590
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004528b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004529a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x427615
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004528b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x427637
mov rax, qword [rsp + 0x88]
mov qword [0x004529a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00452948], rax
mov rax, qword [0x004529a8]
mov qword [0x00452820], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00452930], rax
mov dword [0x00452810], 0xc0000409
mov dword [0x00452814], 1
mov rax, qword [0x0044cf98]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0044cfa0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004528a8], eax
mov ecx, 1
call fcn.00431db0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0043ff18]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004528a8], 0
jne 0x4276be
mov ecx, 1
call fcn.00431db0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x431b10
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.004279d0
xor ebx, ebx
cmp qword [0x004532a0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x431c41
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x431b73
xor eax, eax
jmp 0x431d21
lea rdx, [0x00440af0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x431b6c
mov rcx, rax
call fcn.00427960
lea rdx, [0x00440ae0]
mov rcx, rbp
mov qword [0x004532a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00427960
lea rdx, [0x00440ac8]
mov rcx, rbp
mov qword [0x004532a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00427960
lea rcx, [rsp + 0x30]
mov qword [0x004532b0], rax
call fcn.00425650
test eax, eax
je 0x431bf7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.004273d0
cmp dword [rsp + 0x30], 2
jne 0x431c41
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00427960
test rax, rax
mov qword [0x004532c0], rax
je 0x431c41
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00427960
mov qword [0x004532b8], rax
mov rcx, qword [0x004532b8]
cmp rcx, rsi
je 0x431cd3
cmp qword [0x004532c0], rsi
je 0x431cd3
call fcn.00427a30
call rax
test rax, rax
mov rbp, rax
je 0x431c9e
mov rcx, qword [0x004532c0]
call fcn.00427a30
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x431c9e
test byte [rsp + 0x48], 1
jne 0x431cd3
lea rcx, [rsp + 0x34]
call fcn.004256a0
test eax, eax
je 0x431cc0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.004273d0
cmp dword [rsp + 0x34], 4
jb 0x431ccd
bts edi, 0x15
jmp 0x431d07
bts edi, 0x12
jmp 0x431d07
mov rcx, qword [0x004532a8]
cmp rcx, rsi
je 0x431d07
call fcn.00427a30
call rax
test rax, rax
mov rbx, rax
je 0x431d07
mov rcx, qword [0x004532b0]
cmp rcx, rsi
je 0x431d07
call fcn.00427a30
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004532a0]
call fcn.00427a30
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1406d0210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406d0397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406d0241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d0227
add dl, dl
jne 0x1406d024e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d02ae
xor eax, eax
add dl, dl
jne 0x1406d025d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d0365
add dl, dl
jne 0x1406d026e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d027b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d0288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d0295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406d02a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406d0236
mov eax, 1
add dl, dl
jne 0x1406d02be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d02cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d02b3
sub eax, ebx
mov ebx, 1
jne 0x1406d0304
mov ecx, 1
add dl, dl
jne 0x1406d02e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d02f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d02db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d0236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406d0320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d032d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d0315
cmp eax, 0x7d00
jae 0x1406d0353
cmp eax, 0x500
jb 0x1406d034e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d0236
cmp eax, 0x7f
ja 0x1406d0356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d0236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406d038a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406d0236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140007e98
test r8, r8
jle 0x140007e90
nop word [rax + rax]
mov rcx, rdi
call fcn.14000b760
test rax, rax
jle 0x140007e6e
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.14001fed0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140007e88
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007e90
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140007e30
sub r14, rbx
mov rax, r14
jmp 0x140007f16
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x140007eb1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140007eb3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x140007f0b
test ecx, ecx
jle 0x140007eec
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.14001fed0
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x140007f0b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140007f0b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.14002b50c
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140007f30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140007f52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140007fcc
mov rdi, r14
mov rcx, rbx
call fcn.14000b780
test rax, rax
jle 0x140007fa4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14001fed0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140007fbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140007fc4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140007f66
sub r14, rdi
jmp 0x1400080af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140007fe3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140007fe5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008017
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14001fed0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400080ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008052
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000808d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14002bca0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400080ac
cmp rbp, rax
ja 0x140008060
test rbp, rbp
je 0x1400080ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14002bca0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret