joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800848c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
cmp byte [rcx + 8], 0
je 0x180084a4e
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180084a4e
mov rsi, qword [0x180313008]
cmp qword [rsi + 8], 0
je 0x180084a4e
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180005460
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180311750]
call fcn.18006f780
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x320]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r9
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180084998
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180084993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180084993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009c624
cmp ebx, 4
jne 0x180084a4e
mov rsi, qword [0x180313008]
mov edi, dword [rdi + 0x18]
cmp qword [rsi + 8], 0
je 0x180084a4e
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180005460
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180311750]
call fcn.18006f780
mov r8, qword [rbx]
mov r10, qword [r8 + 0x368]
mov r9d, edi
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r10
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180084a4e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180084a49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180084a49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18009c624
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18008a740
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [rcx + 8], 0
mov rbx, r8
mov rdi, rcx
je 0x18008a831
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008a831
mov rcx, rbx
call fcn.1800683a0
test al, al
je 0x18008a831
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rbx
movaps xmmword [rsp + 0x50], xmm8
call fcn.180068080
movss xmm7, dword [rdi + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, rbx
cvtps2pd xmm7, xmm7
call fcn.180067ee0
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x1803006b8]
mulsd xmm8, qword [0x1803006b8]
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm1, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mulsd xmm0, xmm6
mov rcx, rbx
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.1800688c0
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x18008ae20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [rcx + 8], 0
mov rdi, r8
mov rbx, rcx
je 0x18008af52
lea rdx, [rsp + 0x30]
mov rcx, r8
call fcn.180068080
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008aef4
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rdi
movss xmm7, dword [rbx + 0x18]
cvtps2pd xmm7, xmm7
movaps xmmword [rsp + 0x50], xmm8
call fcn.180067ee0
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x1803006b8]
mulsd xmm8, qword [0x1803006b8]
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm1, qword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008af0e
movss xmm0, dword [rbx + 0x18]
cvtps2pd xmm0, xmm0
jmp 0x18008af33
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18008af30
movss xmm0, dword [rbx + 0x18]
xorps xmm0, xmmword [0x180300a60]
cvtss2sd xmm0, xmm0
jmp 0x18008af33
xorps xmm0, xmm0
mov rcx, rdi
movsd qword [rsp + 0x38], xmm0
call fcn.1800683a0
test al, al
jne 0x18008af52
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1800688c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x18008e2f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180310040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
call fcn.18006be70
call fcn.1800892f0
mov rbx, qword [0x180313008]
test rbx, rbx
je 0x18008e33b
mov rcx, rbx
call fcn.18008e580
mov edx, 0xf8
mov rcx, rbx
call fcn.18009c624
mov qword [0x180313008], rsi
mov rcx, qword [0x1803110d0]
test rcx, rcx
je 0x18008e383
call fcn.18006d280
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18008e383
nop
mov rcx, qword [0x1803110d0]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
mov rdx, qword [rbx + 0x30]
call r8
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x18008e360
mov rcx, qword [0x180311670]
test rcx, rcx
je 0x18008e39b
mov rax, qword [rcx]
mov rdx, qword [rax + 0x3f0]
call rdx
call fcn.18006bae0
mov rcx, qword [0x180311620]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180311648]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180311640]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [0x180311630]
test rcx, rcx
je 0x18008e3de
call fcn.18008e4c0
mov rcx, qword [0x180311618]
test rcx, rcx
je 0x18008e3ef
call fcn.18008e4c0
cmp qword [0x180311598], rsi
je 0x18008e404
lea rcx, [0x180311598]
call fcn.18008ec50
mov qword [0x1803110d0], rsi
mov ecx, 0x10
call fcn.18009c1a0
mov rcx, qword [0x180311698]
mov qword [rax], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x18008eb40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18008e4a5
cmp dword [rsp + 0x38], 0
je 0x18008e499
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x18008e499
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18009c060
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x18008e4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180310040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x18008e555
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x18008e531
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18008e531
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.18009c624
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c060
add rsp, 0x30
pop rbx
ret
Function at 0x18008e7e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180310040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x18008dbc0]
mov qword [rcx + 8], rax
mov rcx, qword [0x180311650]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006bdc0
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov byte [rbx + 1], al
lea r8d, [rdx + 0x32]
call fcn.18006cdb0
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18008e87c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.1800046b0
jmp 0x18008e97a
mov rax, qword [rbx + 8]
mov r8d, 0x3000
mov qword [rbx + 0x2e], rax
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18008e864
mov qword [0x180311638], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
lea r8d, [rdx + 0x3b]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18008e94b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.1800046b0
jmp 0x18008e975
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c060
add rsp, 0x30
pop rbx
ret
Function at 0x18008e990
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180310040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x18008dae0]
mov qword [rcx + 8], rax
mov rcx, qword [0x180311610]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006bdc0
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov byte [rbx + 1], al
lea r8d, [rdx + 0x32]
call fcn.18006cdb0
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x18008ea2c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.1800046b0
jmp 0x18008eb2a
mov rax, qword [rbx + 8]
mov r8d, 0x3000
mov qword [rbx + 0x2e], rax
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18008ea14
mov qword [0x180311628], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
lea r8d, [rdx + 0x3b]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18008eafb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.1800046b0
jmp 0x18008eb25
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c060
add rsp, 0x30
pop rbx
ret
Function at 0x180090fb0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x180091099.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0x91218]
mov ecx, dword [rsi + rax*4 + 0x911ec]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x180090fe0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xa5d70]
mov rcx, rdi
call fcn.18008f860
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x180091099.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.18008f860
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x180091099.4
cdqe
movzx eax, byte [rsi + rax + 0x91248]
mov ecx, dword [rsi + rax*4 + 0x9123c]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180092050
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180091270
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.18008fde0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.18008f830
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x18009112e
lea edx, [rax + 0x35]
jmp 0x180091140
cmp eax, 1
jne 0x18009113b
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x180091145
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18008f860
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xa5f30]
call fcn.18008f860
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x180091187
lea edx, [rax + 0x31]
jmp 0x180091199
cmp eax, 1
jne 0x180091194
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x18009119e
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.18008f860
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x18009102e
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x180091036
movsxd rax, dword [rbx + 0x98]
jmp 0x18009102e
Function at 0x180692058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1806921df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180692089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069206f
add dl, dl
jne 0x180692096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806920f6
xor eax, eax
add dl, dl
jne 0x1806920a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806921ad
add dl, dl
jne 0x1806920b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806920c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806920d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806920dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806920ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18069207e
mov eax, 1
add dl, dl
jne 0x180692106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180692113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806920fb
sub eax, ebx
mov ebx, 1
jne 0x18069214c
mov ecx, 1
add dl, dl
jne 0x18069212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18069213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180692123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180692168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180692175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069215d
cmp eax, 0x7d00
jae 0x18069219b
cmp eax, 0x500
jb 0x180692196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069207e
cmp eax, 0x7f
ja 0x18069219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806921d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18069207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005c50
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140005c7e
xor eax, eax
jmp 0x140005d64
cmp qword [rcx + 0x68], 0
je 0x140005c8f
call fcn.1400037c0
jmp 0x140005d64
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005ca6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005ca8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005cda
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140027170
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140005d5e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140005d11
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140005d3a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400140a4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140005d5e
cmp rsi, rbx
ja 0x140005d18
test rsi, rsi
je 0x140005d5e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400140a4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140007778
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400077c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400077c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400077c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400077c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400077c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400077c4
xor al, al
add rsp, 0x28
ret

Function at 0x140016374
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140016170
Function at 0x14001cc24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400073f0
sub rsp, rax
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001a394
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001cc73
mov rax, rbp
jmp 0x14001cd7b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x3e260]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14001dd44
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x3e260]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001cd77
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cd77
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14001dd44
test rax, rax
js 0x14001cd77
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001cd77
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14001cd69
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14001cd69
cmp byte [rcx], 0xd
jne 0x14001cd4f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14001cd5e
cmp byte [rcx + 1], 0xa
jne 0x14001cd5e
inc rcx
jmp 0x14001cd5e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3c470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14001cd31
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14001cd7b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140006af0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14001cf9c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001cfb2
mov al, 1
jmp 0x14001d012
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001cfc3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001d010
mov ecx, dword [rcx + 0x18]
nop
call fcn.140021858
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d010
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001d010
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001d010
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001d012
xor al, al
add rsp, 0x20
pop rbx
ret