joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068690
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
mov r14, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rbx + 0x11]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [rbx + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [rbx + 0x13]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140068723
cmp rax, rbx
jne 0x140068719
mov rax, qword [r9 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14006872e
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14006872e
cmp rax, rbx
jne 0x14006872e
mov rax, qword [rbx]
mov qword [rdx], rax
mov rbp, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rbp
mov rax, qword [rbx + 8]
mov qword [rbp + 8], rax
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140068783
mov qword [rsp + 0x30], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14006877e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14006877e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + ioctlsocket]
mov rsi, qword [rsp + 0x30]
mov edx, Ordinal_41
mov rcx, rbx
call fcn.1402434a4
mov rbx, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x48]
mov qword [r14], rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14006ad70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14006af32
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140014cc0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14006aef7
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14006ae63
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14006aee6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x14006aea0
mov r10, qword [rax]
cmp r10, rcx
je 0x14006ae9a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14006aee6
mov r8, rax
cmp r10, rax
je 0x14006aec2
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x14006af0c
cmp r10, rax
jne 0x14006aeb0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14006ae10
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14006aee6
lea rcx, str.invalid_hash_bucket_count
call fcn.14023f374
int3
Function at 0x14006d610
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov r14d, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
mov rsi, qword [rdx]
lea rbx, [rsi - 0x10]
mov rbp, rbx
cmp qword [rbx], rsi
je fcn.14006d670
mov rdi, qword [rbx + 8]
mov rcx, qword [rdi + 0x60]
call fcn.14006d790
cmp eax, r14d
je 0x14006d68d
mov rbx, qword [rbx]
cmp rbx, rbp
je fcn.14006d670
cmp qword [rbx], rsi
jne 0x14006d651
mov rax, qword [rdi + 0x30]
jmp 0x14006d672

Function at 0x14006d6a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi

Function at 0x14006d6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r15d, edx
mov rbp, rcx
mov esi, dword [rax + rcx + 0x88]
add rsi, rcx
mov r12d, dword [rsi + 0x1c]
mov r14d, dword [rsi + 0x20]
add r12, rcx
mov r13d, dword [rsi + 0x24]
add r14, rcx
add r13, rcx
cmp dword [rsi + 0x18], ebx
jbe 0x14006d70f
nop dword [rax]
movzx edi, bx
mov ecx, dword [r14 + rdi*4]
add rcx, rbp
call fcn.14006d740
cmp eax, r15d
je 0x14006d72e
inc bx
movzx eax, bx
cmp eax, dword [rsi + 0x18]
jb 0x14006d6f0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rdi*2]
mov eax, dword [r12 + rax*4]
add rax, rbp
jmp 0x14006d711

Function at 0x14006d740
Capabilities:
Hash data using djb2

Disassembly:
movsx r9d, byte [rcx]
lea r10, [rcx + 1]
mov eax, 0x1505
test r9d, r9d
je 0x14006d783
nop dword [rax]
nop word [rax + rax]
lea edx, [r9 - 0x41]
cmp edx, 0x19
lea r8d, [r9 + 0x20]
lea r10, [r10 + 1]
cmova r8d, r9d
cmova eax, ecx
movsx r9d, byte [r10 - 1]
imul eax, eax, 0x21
add eax, r8d
test r9d, r9d
jne 0x14006d760
ret

Function at 0x14006d790
Capabilities:
Hash data using djb2

Disassembly:
movzx r9d, word [rcx]
lea r10, [rcx + 2]
mov eax, 0x1505
test r9d, r9d
je 0x14006d7d3
nop dword [rax]
nop word [rax + rax]
lea edx, [r9 - 0x41]
cmp edx, 0x19
lea r8d, [r9 + 0x20]
lea r10, [r10 + 2]
cmova r8d, r9d
movzx r9d, word [r10 - 2]
imul eax, eax, 0x21
add eax, r8d
test r9d, r9d
jne 0x14006d7b0
ret

Function at 0x140070ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140070eff
or ebx, 2
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140070f12
or ebx, 1
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140070f25
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140070f38
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140074410
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rdi, rcx
mov r15, r9
add rcx, 0x358
mov r14, r8
mov esi, edx
xor ebx, ebx
call fcn.14006c0b0
test eax, eax
jle 0x140074499
mov edx, ebx
mov byte [rsp + 0x90], 0
lea rcx, [rdi + 0x358]
call fcn.14006b790
lea rcx, [rsp + 0x90]
mov r9, r15
mov qword [rsp + 0x20], rcx
mov r8, r14
mov edx, esi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rsp + 0x90], 0
jne 0x14007463a
lea rcx, [rdi + 0x358]
inc ebx
call fcn.14006c0b0
cmp ebx, eax
jl 0x140074445
sub esi, 0x100
je 0x1400745ac
sub esi, 4
je 0x140074529
cmp esi, 2
jne 0x140074590
cmp qword [rdi + 0x128], 0
je 0x140074590
mov ecx, r14d
mov dword [rsp + 0x90], 0
call fcn.140256490
mov rcx, qword [rdi + 0x128]
lea r8, [rsp + 0x90]
mov word [rsp + 0x90], ax
lea rdx, [0x140076c70]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x350]
mov rbx, rax
test rax, rax
je 0x140074590
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x2f0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x108]
mov al, 1
jmp 0x140074592
mov rax, qword [rdi + 0x130]
test rax, rax
je 0x140074590
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov rax, qword [rdi + 0x160]
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x40], 0
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x54], r14w
call fcn.140070ed0
mov word [rsp + 0x56], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x130]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x48], eax
mov rax, qword [rcx]
call qword [rax + 0x370]
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp r14, 9
jne 0x140074641
mov rcx, qword [rdi + 0x130]
test rcx, rcx
je 0x14007461b
mov rax, qword [rcx]
call qword [rax + 0x2a0]
test al, al
je 0x14007461b
mov rcx, qword [rdi + 0x130]
mov rax, qword [rcx]
call qword [rax + 0x2b8]
test al, al
je 0x14007461b
mov rcx, qword [rdi + 0x130]
mov rax, qword [rcx]
call qword [rax + 0xe8]
mov rcx, rax
lea rdx, str.RichEdit
call fcn.140244740
test rax, rax
je 0x14007461b
mov rcx, qword [rdi + 0x130]
call fcn.14008da20
test al, al
jne 0x140074590
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rdi
setns dl
xor r9d, r9d
xor r8d, r8d
call fcn.140075cd0
mov al, 1
jmp 0x140074592
cmp r14, 0x75
jne 0x140074590
lea ecx, [r14 - 0x65]
call qword [sym.imp.USER32.dll_GetKeyState]
mov r9b, 1
mov rcx, rdi
test ax, ax
setns dl
xor r8d, r8d
call fcn.140075cd0
mov al, 1
jmp 0x140074592
Function at 0x140075cd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
cmp byte [rcx + 0x1ad], 0
movzx esi, r9b
movzx ebp, r8b
movzx ebx, dl
mov rdi, rcx
je 0x140075d20
test dl, dl
je 0x140075d20
mov byte [rcx + 0x1ae], 1
xor r8d, r8d
mov rcx, qword [rcx + 0x88]
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140075ecc
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r9d, 0x80000023
mov rax, qword [rcx + 0x130]
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x52], sil
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
test bpl, bpl
je 0x140075d5a
test bl, bl
mov eax, 0x80000033
cmove r9d, eax
mov rcx, qword [rcx + 0x128]
lea r8, [rsp + 0x40]
lea rdx, [0x140076cf0]
mov rax, qword [rcx]
call qword [rax + 0x350]
test rax, rax
jne 0x140075eb3
test bpl, bpl
jne 0x140075e69
mov rcx, qword [rdi + 0x88]
call qword [sym.imp.USER32.dll_GetParent]
mov rbp, rax
test rax, rax
je 0x140075e69
cmp qword [rdi + 0x130], 0
je 0x140075e69
xor ebx, ebx
mov qword [rsp + 0x70], reloc.WS2_32.dll_sendto
xorps xmm0, xmm0
mov qword [rsp + 0x80], rbx
movdqu xmmword [rsp + 0x8c], xmm0
mov qword [rsp + 0x9c], rbx
mov dword [rsp + 0xa4], ebx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x130]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x88], eax
mov rax, qword [rcx]
call qword [rax + 0x370]
mov rdx, qword [rdi + 0x130]
lea r8, str.killfocus
mov byte [rsp + 0x30], 1
xor r9d, r9d
mov byte [rsp + 0x28], bl
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call fcn.1400754f0
lea ecx, [rbx + 0x10]
mov qword [rdi + 0x130], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 1
mov edx, 0x8002
test ax, ax
cmovns ebx, ecx
mov rcx, rbp
mov r8d, ebx
or r8, 2
test sil, sil
cmove r8, rbx
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
xor al, al
jmp 0x140075ece
test bl, bl
je 0x140075ea9
mov rcx, qword [rdi + 0x128]
lea r8, [rsp + 0x58]
xor eax, eax
lea rdx, [0x140076cf0]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], bl
mov r9d, 0x80000023
mov byte [rsp + 0x6a], sil
mov rax, qword [rcx]
call qword [rax + 0x350]
jmp 0x140075eae
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140075ec5
movzx r9d, sil
mov r8b, 1
mov rdx, rax
mov rcx, rdi
call fcn.140075890
mov byte [rdi + 0x1ae], 0
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140079bc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x140079c2b
cmp word [rdx], 0x3c
jne 0x140079c1e
call fcn.140077ed0
test al, al
jne 0x140079cb7
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
call fcn.140078000
jmp 0x140079bfb
call fcn.1400708a0
mov rcx, rax
mov r8, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140079c03
call fcn.1400708a0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
jne 0x140079c6b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140079c03
mov qword [rsi + 0x148], r15
call fcn.1400708a0
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call fcn.140078380
test al, al
je 0x140079c03
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rsi + 0x150], rbp
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rsi
call fcn.1400792c0
jmp 0x140079c05

Function at 0x1400821b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, qword [rcx + 0xe0]
test rax, rax
je 0x1400821cd
mov rdx, rcx
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
jmp fcn.140075890
ret
Function at 0x140090140
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xaf0], 0
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
je 0x140090214
cmp edx, 0x100
jne 0x14009019d
cmp di, 0xd
jne 0x14009019d
cmp byte [rcx + 0xaf9], 0
jne 0x1400901c6
cmp byte [rcx + 0xafb], 0
je 0x1400901df
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400901df
mov rax, qword [rbx + 0xaf0]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov r10, qword [rax + 0x18]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call r10
jmp 0x140090219
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14009019d
cmp byte [rbx + 0xafb], 0
jne 0x14009019d
mov rcx, qword [rbx + 0xe0]
test rcx, rcx
je 0x140090210
mov byte [rsp + 0x30], 1
lea r8, str.return
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], 0
call fcn.1400754f0
xor eax, eax
jmp 0x140090219
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140091510
Capabilities:
Create directory

Disassembly:
test rdx, rdx
je 0x140091639
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
movzx eax, word [rdx]
mov rdi, rdx
mov rbx, rcx
test ax, ax
je 0x140091619
mov qword [rsp + 0x470], rsi
mov rcx, rdx
mov rsi, rdx
cmp ax, 0x2f
je 0x140091564
cmp ax, 0x5c
jne 0x140091567
mov rsi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140091558
cmp rsi, rdi
je 0x1400915b0
sub rsi, rdi
lea rcx, [rsp + 0x20]
sar rsi, 1
mov r8, rsi
call fcn.14025be48
add rsi, rsi
cmp rsi, 0x208
jae 0x14009163a
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + rsi + 0x20], ax
call fcn.140091510
lea rcx, [rsp + 0x230]
sub rcx, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400915c0
lea rcx, [rsp + 0x230]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400915e0
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400915f0
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1402435c0
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rdi
ret
call fcn.1402438c8
int3
Function at 0x140091cf0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r15, rcx
mov ebp, r8d
mov ecx, 0x348
mov r12d, edx
call fcn.140242f80
xor esi, esi
mov qword [rsp + 0x88], rax
mov rdi, rax
test rax, rax
je 0x140091d37
mov qword [rax], rsi
mov dword [rax + 8], 0xffffffff
mov dword [rax + 0x138], 0xffffffff
jmp 0x140091d3a
mov rdi, rsi
cmp qword [rdi], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r14
jne 0x140091f02
cmp dword [rdi + 8], 0xffffffff
jne 0x140091f02
lea rbx, [rdi + 0x13c]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x140091d71
mov eax, dword [0x140284c9c]
mov dword [rbx], eax
cmp ebp, 1
jne 0x140091da5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebp
je 0x140091db7
mov dword [0x140373064], 0x2000000
jmp 0x140091f0c
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x140091db7
mov eax, 0x10000
jmp 0x140091ee4
xor r14b, r14b
mov qword [rsp + 0x88], rsi
cmp ebp, 1
je 0x140091e12
cmp ebp, 2
jne 0x140091e6e
mov qword [rsp + 0x30], rsi
lea r8d, [rbp - 1]
mov dword [rsp + 0x28], Ordinal_133
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x140091e5e
mov eax, 0x200
jmp 0x140091ee4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x88]
mov rcx, rax
mov dword [rsp + 0x28], esi
mov r8, rbx
mov dword [rsp + 0x20], esi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x140091e56
mov eax, 0x100
jmp 0x140091ee4
mov rax, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
sete r14b
mov ecx, Ordinal_41
call fcn.140242f80
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x140091e98
mov word [rax], 0x100
mov qword [rax + 0x18], r15
mov dword [rax + 0x20], r12d
mov dword [rax + 0x24], esi
mov dword [rax + 0x14], esi
jmp 0x140091ed3
mov byte [rax], 1
mov byte [rax + 1], r14b
mov rax, qword [rsp + 0x88]
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], 0
mov dword [rbx + 0x14], esi
test r14b, r14b
je 0x140091ed3
mov rcx, qword [rsp + 0x88]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1400951b0
mov qword [rdi], rax
mov eax, dword [0x140373068]
mov dword [0x140373064], eax
test eax, eax
jne 0x140091f0c
lea ecx, [rax + 0x10]
call fcn.140242f80
mov dword [rax], 1
mov qword [rax + 8], rdi
jmp 0x140091f16
mov dword [0x140373064], 0x1000000
mov rcx, rdi
call fcn.1400c3820
xor eax, eax
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140094a20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140094a7a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140094a66
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.140245860
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140094b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x140094b5b
xor eax, eax
ret
lea r11, [0x140294720]
not ecx
cmp r8d, 8
jb 0x140094c31
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140094b80
test r8d, r8d
je 0x140094c5d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140094c40
not ecx
mov eax, ecx
ret
Function at 0x140096110
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x140096160
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14009615a
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x140096197
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x140096176
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.140245860
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x1400961b8
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400961ae
cmp byte [rbx + 0x10], 0
je 0x1400961ae
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400ac8f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0xab8]
test rcx, rcx
je 0x1400ac909
mov rax, qword [rcx]
jmp qword [rax + 0x2f0]
mov rcx, rax
jmp method.DuiLib::CCheckBoxUI.virtual_752