joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4119a0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040ce40
mov rcx, qword [rbp + 0x90]
call fcn.0040ce40
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040ccb0
cmp qword [rbp + 0x90], 0
je 0x411b66
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040d380
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x411a51
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x411a8b
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x411a84
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.0040e700
jmp 0x411a8b
sub eax, 1
test eax, eax
jne 0x411a56
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.00411570
cmp qword [rbp + 0x68], 0
je 0x411ac9
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00411720
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040d300
jmp 0x411b65
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00410cc0
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00411720
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040d300
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x411b3e
cmp byte [0x008b3c88], 0
jne 0x411b3e
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00410cc0
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00411720
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040d300
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x411b65
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.00411860
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040d300
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040cd90
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040cd90
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x412810
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x412830
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call sub.kernel32.dll_GetVersion
mov ecx, eax
and ecx, 0xff
and eax, 0xff00
shr eax, 8
cmp ecx, 5
jne 0x412854
cmp eax, 1
jae 0x412859
cmp ecx, 5
jbe 0x412865
mov dword [0x008af9b0], 0x7f
jmp 0x41286f
mov dword [0x008af9b0], 0x409
add rsp, 0x28
ret
Function at 0x412ac0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00412ab0
mov ebx, eax
test ebx, ebx
je 0x412b0b
cmp dword [0x0086126c], 0xffffffff
jne 0x412ae4
mov ecx, 0xe2
call fcn.0040c960
mov ecx, ebx
call fcn.00412a90
test rax, rax
jne 0x412afd
mov ecx, 0xe2
call fcn.0040c960
jmp 0x412b0b
mov ecx, dword [0x0086126c]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret

Function at 0x412b20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x008b3d64], 0
je 0x412b5b
mov ecx, dword [0x0086126c]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x412b6f
call fcn.00412ac0
mov ecx, dword [0x0086126c]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x412b6f
mov rax, qword [0x008b3d98]
jmp 0x412b6f
mov rax, qword gs:[0x58]
movsxd rcx, dword [0x0086126c]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x42a430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rcx, rbx
call fcn.0040e090
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x42a4e2
mov ecx, eax
test ecx, 0x400
je 0x42a4d7
test sil, sil
jne 0x42a46f
mov al, 1
jmp 0x42a50c
test eax, 0x10
je 0x42a47f
xor rax, rax
jmp 0x42a50c
mov rcx, rbx
call fcn.0040e090
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x42a4ca
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x42a50c
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x20
sete al
jmp 0x42a50c
test eax, 0x10
sete al
jmp 0x42a50c
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x42a505
cmp eax, 3
je 0x42a505
cmp eax, 0x7b
je 0x42a505
mov rcx, rbp
mov rdx, rbx
call fcn.0042a3e0
test al, al
jne 0x42a50a
xor rax, rax
jmp 0x42a50c
mov al, 1
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret
Function at 0x42a520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
xor rdi, rdi
mov rcx, rbx
call fcn.0040e090
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov r13d, eax
cmp r13d, 0xffffffff
je 0x42a62c
mov eax, r13d
test eax, 0x400
jne 0x42a56a
test r13d, 0x10
setne dil
jmp 0x42a65f
test sil, sil
je 0x42a5ca
mov rcx, rbx
call fcn.0040e090
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x42a65f
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
test r13d, 0x10
setne dil
jmp 0x42a65f
test r13d, 0x10
je 0x42a5db
mov dil, 1
jmp 0x42a65f
mov rcx, rbx
call fcn.0040e090
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
cmp rax, 0xffffffffffffffff
je 0x42a627
mov rcx, rax
call sub.kernel32.dll_CloseHandle_1
xor rdi, rdi
jmp 0x42a65f
mov dil, 1
jmp 0x42a65f
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x42a657
cmp eax, 3
je 0x42a657
cmp eax, 0xa1
je 0x42a657
cmp eax, 0x7b
je 0x42a657
cmp eax, 0x35
je 0x42a657
cmp eax, 0x15
je 0x42a657
cmp eax, 0x43
jne 0x42a65c
xor rdi, rdi
jmp 0x42a65f
mov dil, 1
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x4331b0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
sub rsp, 0x38
mov rbp, rsp
mov ebx, r8d
lea r8, [rbp + 0x2c]
mov r9d, 2
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4331d7
movzx rax, word [rbp + 0x2c]
jmp 0x4331d9
mov eax, ebx
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x434830
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x8e0
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea r8, [rbp + 0x60]
mov r9d, 0x400
call fcn.004345d0
mov ebx, eax
mov rax, qword [0x008adfc8]
cmp byte [rax], 0
je 0x434968
mov rcx, qword [0x008ad5f0]
call fcn.00408e20
call fcn.00406970
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov esi, eax
lea rcx, [rbp + 0x58]
mov rdx, qword [0x004347f0]
mov r8d, 1
movsxd r9, esi
call fcn.0040fd70
mov ecx, 1
xor rdx, rdx
lea r8, [rbp + 0x60]
mov r9d, ebx
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.kernel32.dll_WideCharToMultiByte_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
mov rdx, qword [rbp + 0x58]
mov r8d, esi
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
mov ecx, 0xfffffff4
call sub.kernel32.dll_GetStdHandle_1
mov rcx, rax
lea rdx, [0x00434a08]
mov r8d, 2
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
jmp 0x4349ae
mov rcx, qword [0x008b3d68]
call fcn.004102e0
mov rcx, rax
mov rax, qword [0x008ad450]
mov edx, dword [rax + 8]
lea r8, [rbp + 0x860]
mov r9d, 0x40
call sub.user32.dll_LoadStringW_1
xor rcx, rcx
lea rdx, [rbp + 0x60]
lea r8, [rbp + 0x860]
mov r9d, 0x2010
call sub.user32.dll_MessageBoxW
nop
lea rcx, [rbp + 0x58]
mov rdx, qword [0x004347f0]
call fcn.0040ff50
lea rsp, [rbp + 0x8e0]
pop rbx
pop rsi
pop rbp
ret

Function at 0x435ea0
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
nop
mov dword [rbp + 0x54], 0xffffffff
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x70]
call fcn.0040d380
lea rcx, [rbp + 0x48]
call fcn.0040d5c0
mov rcx, qword [rbp + 0x48]
call fcn.0040e090
mov rcx, rax
lea rdx, [rbp + 0x40]
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x435f51
mov ecx, dword [rbp + 0x44]
call fcn.00406630
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x48]
call fcn.0040e090
mov rcx, rax
mov edx, dword [rbp + 0x40]
mov r8d, dword [rbp + 0x44]
mov r9, qword [rbp + 0x58]
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x435f47
mov rcx, qword [rbp + 0x58]
lea rdx, [0x00435fc4]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x34]
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x435f47
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 8]
mov dword [rbp + 0x54], eax
nop
mov rcx, qword [rbp + 0x58]
call fcn.00406660
nop
lea rcx, [rbp + 0x48]
call fcn.0040ccb0
mov eax, dword [rbp + 0x54]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x436c80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x240
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
call fcn.0040d4a0
mov r13d, eax
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004127f0
mov esi, eax
cmp esi, 0x104
jbe 0x436cdd
mov ecx, esi
add ecx, ecx
mov ecx, ecx
call fcn.00406630
mov rdi, rax
jmp 0x436ce1
lea rdi, [rbp + 0x38]
mov ecx, 0xfde9
xor rdx, rdx
mov r8, rbx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], esi
call fcn.004127f0
mov rax, rdi
mov rcx, rax
call sub.user32.dll_CharUpperW
xor rbx, rbx
xor rax, rax
mov ecx, esi
sub ecx, 1
cmp eax, ecx
jg 0x436d37
add ecx, 1
mov edx, ebx
shl edx, 5
shr ebx, 0x1b
or edx, ebx
mov ebx, edx
movsxd rdx, eax
movzx edx, word [rdi + rdx*2]
xor ebx, edx
add eax, 1
cmp eax, ecx
jne 0x436d1b
nop
lea rax, [rbp + 0x38]
cmp rdi, rax
je 0x436d49
mov rcx, rdi
call fcn.00406660
mov eax, ebx
lea rsp, [rbp + 0x240]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret

Function at 0x4fac00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x008b8488], 0
jne 0x4facb5
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x008b8480]
mov qword [rbx], rax
lea rcx, [0x00872598]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.00406a00
lea rax, [0x004fabc0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.004fabf0
mov dword [rsi + 1], eax
mov rax, qword [0x008b8488]
mov qword [rsi + 5], rax
mov qword [0x008b8488], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x4fac73
mov qword [0x008b8480], rbx
mov rax, qword [0x008b8488]
mov rsi, qword [0x008b8488]
mov rcx, qword [rsi + 5]
mov qword [0x008b8488], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x546bf0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x546c32
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x546c03
nop
ret
Function at 0x68fda0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x68ffd2
mov rcx, qword [0x004b2180]
mov dl, 1
call fcn.004e2e80
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040ccb0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x68ffaa
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.0059ee90
test al, al
je 0x68ff94
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x00690064]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.0042b210
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x68ff94
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006900d2]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x68ff87
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040e190
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x68ff87
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040e190
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x68fe48
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.004e2d30
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040ccb0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x691360
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x008b8a70]
cmp byte [rax + 0x151], 0
jne 0x691403
cmp qword [0x008b8aa8], 0
jne 0x6913a6
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x00891648]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x008b8aa8], rax
cmp qword [0x008b8aa0], 0
jne 0x6913c8
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x008b8aa0], rax
cmp qword [0x008b8ab0], 0
jne 0x691403
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00891640]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x008b8ab0], rax
add rsp, 0x48
ret

Function at 0x692850
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2c8], 0
je 0x69293b
cmp dword [rbx + 0x120], 0
jne 0x692931
mov rax, qword [rbx + 0x2c8]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x00692730]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x118]
cmp dword [rax + 0x10], 0
je 0x692931
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6928df
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x118]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x692930
mov rcx, qword [rbx + 0x118]
mov edx, esi
call fcn.004dc580
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6928f0
nop
lea rax, [rbx + 0x120]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x692c50
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x008b8a70]
cmp qword [rax + 0x2c8], 0
je 0x692e16
test sil, sil
jne 0x692d38
cmp dword [rbx + 0x130], 0
jne 0x692d29
mov rcx, rbx
call fcn.00697210
lea rcx, [0x00692b20]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x692ceb
mov rax, qword [0x008b8a70]
cmp byte [rax + 0x18b], 0
je 0x692ceb
mov rcx, qword [rbx + 0x198]
call fcn.0040f9e0
mov rdi, rax
test edi, edi
jl 0x692cea
mov rax, qword [rbx + 0x198]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x692ccc
nop
mov rax, qword [rbx + 0x128]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x692d28
mov rcx, qword [rbx + 0x128]
mov edx, edi
call fcn.004dc580
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x692cfc
nop
lea rax, [rbx + 0x130]
add dword [rax], 1
jmp 0x692e16
cmp dword [rbx + 0x130], 0
jle 0x692e16
lea rax, [rbx + 0x130]
sub dword [rax], 1
cmp dword [rbx + 0x130], 0
jne 0x692e16
cmp qword [rbx + 0xa8], 0
je 0x692dab
mov rax, qword [0x008b8a70]
cmp byte [rax + 0x18b], 0
je 0x692dab
mov rcx, qword [rbx + 0x198]
call fcn.0040f9e0
mov rdi, rax
test edi, edi
jl 0x692daa
mov rax, qword [rbx + 0x198]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x692d89
nop
mov rax, qword [rbx + 0x128]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x692de8
mov rcx, qword [rbx + 0x128]
mov edx, edi
call fcn.004dc580
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x692dbc
nop
mov rax, qword [rbx + 0x128]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x198]
mov rdx, qword [0x0067d468]
mov r8d, 1
xor r9, r9
call fcn.0040fd70
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14037214c
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14045eb18]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140372196
call fcn.14034e8d4
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.14034e8b4
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14034f96c
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14016e250
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1403721a1
lea eax, [rbx + 1]
jmp 0x140372183
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140372181
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140372183

Function at 0x141299058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1412991df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141299089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14129906f
add dl, dl
jne 0x141299096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412990f6
xor eax, eax
add dl, dl
jne 0x1412990a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412991ad
add dl, dl
jne 0x1412990b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412990c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412990d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412990dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1412990ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14129907e
mov eax, 1
add dl, dl
jne 0x141299106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141299113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412990fb
sub eax, ebx
mov ebx, 1
jne 0x14129914c
mov ecx, 1
add dl, dl
jne 0x14129912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14129913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141299123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14129907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141299168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141299175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14129915d
cmp eax, 0x7d00
jae 0x14129919b
cmp eax, 0x500
jb 0x141299196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14129907e
cmp eax, 0x7f
ja 0x14129919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14129907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1412991d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14129907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20