joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001908
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [0x1400077c0], 0
jne 0x140001aa6
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x140001ac8
mov r9d, 0x20202020
mov rdi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x14000198b
lea rdx, [rdi + rcx]
mov ecx, dword [rdx + 0xc]
mov eax, dword [rcx + rdi]
or eax, r9d
cmp eax, 0x6c64746e
jne 0x14000198b
mov eax, dword [rcx + rdi + 4]
or eax, r9d
cmp eax, 0x6c642e6c
je 0x140001997
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001957
test rdx, rdx
je 0x140001ac8
mov r15d, dword [rdx + 0x1c]
mov r14d, dword [rdx + 0x20]
add r15, rdi
mov r12d, dword [rdx + 0x24]
add r14, rdi
mov ebp, dword [rdx + 0x18]
add r12, rdi
xor esi, esi
lea eax, [rbp - 1]
mov ecx, dword [r14 + rax*4]
mov ebp, eax
add rcx, rdi
mov r13d, eax
mov eax, 0x775a
cmp word [rcx], ax
jne 0x140001a0f
mov ebx, esi
add rbx, rbx
call fcn.1400018dc
lea rcx, [0x1400077c0]
inc esi
mov dword [rcx + rbx*8 + 8], eax
movzx eax, word [r12 + r13*2]
lea r13, [0x1400077c0]
mov eax, dword [r15 + rax*4]
and qword [r13 + rbx*8 + 0x10], 0
mov dword [r13 + rbx*8 + 0xc], eax
cmp esi, 0x1f4
je 0x140001a1a
jmp 0x140001a16
lea r13, [0x1400077c0]
test ebp, ebp
jne 0x1400019ba
xor r8d, r8d
mov dword [0x1400077c0], esi
lea eax, [rsi - 1]
test eax, eax
je 0x140001aa6
mov eax, esi
xor ecx, ecx
sub eax, r8d
cmp eax, 1
je 0x140001a9b
lea r11d, [rcx + 1]
mov r10d, ecx
add r10, r10
mov r9d, r11d
add r9, r9
mov edi, dword [r13 + r10*8 + 0xc]
mov ebx, dword [r13 + r9*8 + 0xc]
cmp edi, ebx
jbe 0x140001a8c
mov eax, dword [r13 + r9*8 + 8]
mov edx, dword [r13 + r10*8 + 8]
mov rcx, qword [r13 + r10*8 + 0x10]
mov dword [r13 + r10*8 + 8], eax
mov rax, qword [r13 + r9*8 + 0x10]
mov qword [r13 + r10*8 + 0x10], rax
mov dword [r13 + r10*8 + 0xc], ebx
mov dword [r13 + r9*8 + 8], edx
mov dword [r13 + r9*8 + 0xc], edi
mov qword [r13 + r9*8 + 0x10], rcx
mov esi, dword [0x1400077c0]
mov eax, esi
mov ecx, r11d
sub eax, r8d
dec eax
cmp r11d, eax
jb 0x140001a36
inc r8d
lea eax, [rsi - 1]
cmp r8d, eax
jb 0x140001a2a
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140001aab

Function at 0x1400027ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002836
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002836
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002836
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002836
cmp dword [rcx + 0x84], 0xe
jbe 0x140002836
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002838
xor al, al
add rsp, 0x28
ret
Function at 0x180001ca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001cc8
xor eax, eax
lea r8, [0x1800019e0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180006010
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000606d
lea rbx, [0x18003bb60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180006054
cmp r10, 2
jb 0x180006054
cmp byte [r9], r8b
jne 0x180006054
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180006030
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800060af
lea rbx, [0x18003bb60]
cmp r8b, 0x23
jne 0x180006093
cmp byte [r9], r8b
jne 0x180006093
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180006080
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180012b10
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x18003bb60]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x405c], ebx
jne 0x180012ba6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18001cca0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180012bb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x18003bb60]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x1800165a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180048010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180048790]
mov edi, ecx
cmp byte [rbx + 0x4d3d], 0
jne 0x180016601
cmp byte [rbx + 0x4d3e], 0
jne 0x180016601
movsx r9d, word [rbx + 0x5ea8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180005f00
test dil, 2
je 0x18001672f
jmp 0x18001668a
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5ea8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x180041c88]
mulss xmm1, dword [0x180041c7c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xf8]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a30], rax
mov dword [rbx + 0x4a1c], 1
movss dword [rbx + 0x4a28], xmm0
movss dword [rbx + 0x4a2c], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x180041bb8]
or dword [rbx + 0x4a18], 0x41
movss dword [rbx + 0x4a78], xmm0
call fcn.180005f00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1800166e0
lea r11, [0x18003bb60]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1800166c3
cmp byte [r8], r9b
jne 0x1800166c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800166b0
not ecx
call fcn.18000caf0
test rax, rax
je 0x18001672f
cmp byte [rax + 0xbe], 0
je 0x18001672f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc6], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5ea8]
movsx r9d, word [rbx + 0x5ea8]
call fcn.180005f00
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.18000f990
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800395d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18001b3a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6000], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x18001b423
xor edx, edx
add rcx, 0x6008
call fcn.18001dac0
mov r8, rsi
lea rcx, [rbx + 0x6008]
mov rdx, rbp
call fcn.180006840
mov eax, dword [rbx + 0x6008]
xor ecx, ecx
mov r9, qword [rbx + 0x6000]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x6010]
cmove edx, ecx
test rax, rax
movsxd r8, edx
lea rcx, [0x180048777]
cmovne rcx, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001b42f
add rcx, 0x6008
call fcn.180006840
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001b880
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180048790]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001b8e3
mov qword [rsp], rbx
lea rbx, [0x18003bb60]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001b8c3
cmp byte [r8], r9b
jne 0x18001b8c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001b8b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f70]
not eax
mov r8, qword [r10 + 0x5f78]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001b90f
cmp dword [r8 + 8], eax
je 0x18001b916
add r8, 0x48
cmp r8, rcx
jne 0x18001b900
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x18001bb60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180048790]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5f5c], ecx
test rbx, rbx
je 0x18001bbcf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.18001bbe0
lea rdx, [0x180041184]
mov rcx, rbx
mov rdi, rax
call fcn.1800060c0
mov rbx, rax
test rax, rax
je 0x18001bbca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18002e320
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180048010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x180048790]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18002e53e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18002e53e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x180048790]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18002e3f4
movsx rdx, word [r8 + 0x60e0]
lea rax, [r8 + 0x60e4]
mov r9d, dword [r8 + 0x3f68]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18002e3e9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60e0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60e4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60d8]
test rdi, rdi
je 0x18002e416
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x2c], rbx
mov qword [rdi + 0x34], rbx
mov qword [rdi + 0x3c], rbx
mov qword [rdi + 0x44], rbx
mov dword [rdi + 0x4c], ebx
jmp 0x18002e419
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x180041938]
mov qword [rsi + 0x80], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18002e45c
mov rsi, qword [r8 + 0x90]
jmp 0x18002e45f
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18002e48a
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x180048790]
mov rcx, qword [rax + 0x4b28]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18002e4fe
inc rbx
cmp rbx, 5
jl 0x18002e4e0
jmp 0x18002e52a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18002e540
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800395d0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18002e730
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180048790]
mov edx, 0x210
call fcn.180012ef0
cmp byte [rax], 0
je 0x18002e7a6
xor edx, edx
mov ecx, 0x210
call fcn.1800155b0
test al, al
je 0x18002e7a6
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002e7a6
mov rbx, qword [0x180048790]
cmp byte [rbx + 0x2b89], 0
je 0x18002e792
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.1800056a0
mov dword [rbx + 0x2e20], 0x210
mov dword [rbx + 0x33e0], 0xa0
mov rcx, qword [0x180048790]
mov edx, 0x214
call fcn.180012ef0
cmp byte [rax], 0
je 0x18002e816
xor edx, edx
mov ecx, 0x214
call fcn.1800155b0
test al, al
je 0x18002e816
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002e816
mov rbx, qword [0x180048790]
cmp byte [rbx + 0x2b89], 0
je 0x18002e802
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.1800056a0
mov dword [rbx + 0x2e24], 0x214
mov dword [rbx + 0x33f0], 0xa1
mov rcx, qword [0x180048790]
mov edx, 0x212
call fcn.180012ef0
cmp byte [rax], 0
je 0x18002e884
xor edx, edx
mov ecx, 0x212
call fcn.1800155b0
test al, al
je 0x18002e884
lea ecx, [rdx + 0x5b]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002e884
mov rbx, qword [0x180048790]
cmp byte [rbx + 0x2b89], 0
je 0x18002e870
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.1800056a0
mov dword [rbx + 0x2d0c], 0x212
mov dword [rbx + 0x33e8], 0x5b
mov rcx, qword [0x180048790]
mov edx, 0x216
call fcn.180012ef0
cmp byte [rax], 0
je 0x18002e8f2
xor edx, edx
mov ecx, 0x216
call fcn.1800155b0
test al, al
je 0x18002e8f2
lea ecx, [rdx + 0x5c]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002e8f2
mov rbx, qword [0x180048790]
cmp byte [rbx + 0x2b89], 0
je 0x18002e8de
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.1800056a0
mov dword [rbx + 0x2d10], 0x216
mov dword [rbx + 0x33f8], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140a23058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a231df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a23089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a2306f
add dl, dl
jne 0x140a23096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a230f6
xor eax, eax
add dl, dl
jne 0x140a230a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a231ad
add dl, dl
jne 0x140a230b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a230c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a230d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a230dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a230ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a2307e
mov eax, 1
add dl, dl
jne 0x140a23106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a23113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a230fb
sub eax, ebx
mov ebx, 1
jne 0x140a2314c
mov ecx, 1
add dl, dl
jne 0x140a2312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a2313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a23123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a2307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a23168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a23175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a2315d
cmp eax, 0x7d00
jae 0x140a2319b
cmp eax, 0x500
jb 0x140a23196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a2307e
cmp eax, 0x7f
ja 0x140a2319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a2307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a231d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a2307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x100401170
Capabilities:
Get common file path

Disassembly:
push r13
push r12
sub rsp, 0x238
mov r9d, dword [global_sysdir_len]
mov r12, rcx
test r9d, r9d
je 0x100401218
cmp qword [0x10040a268], 0
je 0x10040125a
lea r13, str.msys_2.0.dll
mov rcx, r12
mov rdx, r13
call sym.wcscmp
test eax, eax
jne 0x1004011d0
mov r8d, 8
xor edx, edx
mov rcx, r13
add rsp, 0x238
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea r13, [rsp + 0x20]
lea rdx, [0x10040a060]
mov rcx, r13
call sym.wcscpy
mov eax, dword [global_sysdir_len]
mov rdx, r12
lea rcx, [r13 + rax*2]
call sym.wcscpy
mov r8d, 8
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add rsp, 0x238
pop r12
pop r13
ret
lea r13, [0x10040a060]
mov edx, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r8d, r8d
mov ecx, 0x5c
cmp qword [0x10040a268], 0
lea edx, [rax + 1]
mov eax, eax
mov word [r13 + rax*2], cx
mov dword [global_sysdir_len], edx
mov word [r13 + rdx*2], r8w
jne 0x10040119c
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rax, qword [global_set_dll_directory]
test rcx, rcx
je 0x10040128a
lea rdx, str.SetDllDirectoryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [global_set_dll_directory], rax
test rax, rax
je 0x1004012a0
lea rcx, [0x100405bf4]
call rax
jmp 0x10040119c
mov qword [global_set_dll_directory], 0xffffffffffffffff
jmp 0x10040119c

Function at 0x1004012b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov eax, dword [0x10040a02c]
mov ebx, ecx
test eax, eax
je 0x1004012cc
mov ecx, 1
call sym.exit
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8d, ecx
xor edx, edx
mov ecx, 0x1100
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rsi, qword [rsp + 0x48]
call sym.__getreent
mov r8d, ebx
lea rdx, str.Error___d_:__ls_n
mov rcx, qword [rax + 0x18]
mov r9, rsi
call sym.fprintf
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1004012c2
Function at 0x100401fd0
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
mov edx, 0xf003f
xor r8d, r8d
mov ecx, 2
call dbg.find_key(int, unsigned int, int)
mov edx, dword [0x10040a024]
test edx, edx
jne 0x100402030
mov rax, qword [section..bss]
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
test rax, rax
je 0x100402080
mov r8d, dword [0x10040a024]
xor r9d, r9d
call rax
test eax, eax
jne 0x100402088
mov eax, dword [0x10040a030]
test eax, eax
jne 0x100402060
xor eax, eax
add rsp, 0x28
ret
lea rcx, str.advapi32.dll
call dbg._load_sys_library
mov rcx, rax
test rax, rax
je 0x100401ff0
lea rdx, str.RegDeleteKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [section..bss], rax
jmp 0x100401ff7
mov rdx, qword [0x10040a008]
lea rcx, str.subkey__ls_deleted_n
call sym.printf
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x100402016
mov ecx, eax
call dbg.Fail(unsigned int)
nop
Function at 0x100402610
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0xf003f
mov ecx, 2
call dbg.find_key(int, unsigned int, int)
mov rdx, qword [0x10040a008]
mov rcx, qword [0x10040a010]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x10040266a
mov eax, dword [0x10040a030]
test eax, eax
jne 0x100402650
xor eax, eax
add rsp, 0x28
ret
mov rdx, qword [0x10040a008]
lea rcx, str.value__ls_deleted_n
call sym.printf
xor eax, eax
add rsp, 0x28
ret
mov ecx, eax
call dbg.Fail(unsigned int)
nop
nop word cs:[rax + rax]
nop dword [rax]