joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c3640
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006c368c]
mov ecx, 0x10
call fcn.00766d40
test ax, ax
jge 0x6c3663
or si, 1
mov ecx, 0x11
call fcn.00766d40
test ax, ax
jge 0x6c3676
or si, 4
test ebx, 0x20000000
je 0x6c3682
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x6c3700
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x128
lea rcx, [rsp + 0x20]
call fcn.00766d60
lea rcx, [rsp + 0x20]
call fcn.006c3690
add rsp, 0x128
ret
Function at 0x6d2980
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6d2b8d
mov rcx, qword [0x007bb6e0]
mov dl, 1
call fcn.004e9c50
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.004629a0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call fcn.00766d50
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6d2b70
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.0060c470
test al, al
je 0x6d2b57
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006d2bf8]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00478810
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call fcn.00765f78
test eax, eax
jne 0x6d2b57
nop
mov dword [rbp + 0x4f4], pe_nt_image_headers64
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006d2c66]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call fcn.00765f88
test eax, eax
jne 0x6d2b4a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, 0x100
call fcn.00464550
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6d2b4a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, 0x100
call fcn.00464550
nop
mov rcx, qword [rbp + 0x508]
call fcn.00765f28
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6d2a33
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.004e9ad0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.004629a0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6d3c80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x010989c0]
cmp byte [rax + 0x159], 0
jne 0x6d3d1e
cmp qword [0x01098a00], 0
jne 0x6d3cc5
call fcn.00766168
mov ecx, 3
mov rdx, qword [0x0097c850]
xor r8, r8
mov r9d, eax
call fcn.007670a0
mov qword [0x01098a00], rax
cmp qword [0x010989f8], 0
jne 0x6d3ce5
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call fcn.00766008
mov qword [0x010989f8], rax
cmp qword [0x01098a08], 0
jne 0x6d3d1e
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x0097c840]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call fcn.00766050
mov qword [0x01098a08], rax
add rsp, 0x48
ret

Function at 0x6d5050
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2e0]
test rax, rax
je 0x6d512f
cmp dword [rbx + 0x128], 0
jne 0x6d5125
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006d4f50]
lea rdx, [rbp + 0x40]
call fcn.00766c88
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6d5125
mov rcx, qword [rbp + 0x40]
mov edx, 3
call fcn.00766e28
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call fcn.0046ece0
test rax, 8
je 0x6d50d3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6d5124
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004e1e40
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call fcn.00767088
sub esi, 1
cmp esi, 0xffffffff
jne 0x6d50e4
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6d5590
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x010989c0]
cmp qword [rax + 0x2e0], 0
je 0x6d574a
test sil, sil
jne 0x6d5677
cmp dword [rbx + 0x138], 0
jne 0x6d5668
mov rcx, rbx
call fcn.006d9b30
lea rcx, [0x006d5460]
mov rdx, rax
call fcn.00766c88
cmp qword [rbx + 0xa8], 0
je 0x6d562a
mov rax, qword [0x010989c0]
cmp byte [rax + 0x193], 0
je 0x6d562a
mov rcx, qword [rbx + 0x1a0]
call fcn.00467310
mov rdi, rax
test edi, edi
jl 0x6d5629
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call fcn.007670c0
sub edi, 1
cmp edi, 0xffffffff
jne 0x6d560c
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6d5667
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004e1e40
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call fcn.007670b0
sub edi, 1
cmp edi, 0xffffffff
jne 0x6d563b
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6d574a
cmp dword [rbx + 0x138], 0
jle 0x6d574a
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6d574a
cmp qword [rbx + 0xa8], 0
je 0x6d56e9
mov rax, qword [0x010989c0]
cmp byte [rax + 0x193], 0
je 0x6d56e9
mov rcx, qword [rbx + 0x1a0]
call fcn.00467310
mov rdi, rax
test edi, edi
jl 0x6d56e8
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call fcn.007670c0
sub edi, 1
cmp edi, 0xffffffff
jne 0x6d56c8
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6d5726
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004e1e40
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call fcn.007670b0
sub edi, 1
cmp edi, 0xffffffff
jne 0x6d56fa
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x009446b0]
call fcn.00467ad0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6d6a70
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6d6ad7
cmp byte [rbx + 0x193], 0
jne 0x6d6ad7
mov rcx, qword [rbx + 0x2e0]
lea rdx, [rbp + 0x20]
mov r8d, 0x100
call fcn.00766e50
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00462ca0
mov rcx, qword [rsi]
call fcn.00463210
test eax, eax
jne 0x6d6ae6
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00463030
jmp 0x6d6ae6
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00463030
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6e4c30
Capabilities:
Hide graphical window

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
cmp qword [rbx + 0xd0], 0
jne 0x6e4ceb
mov rcx, qword [rbx + 0x10]
call fcn.00602ce0
mov rcx, qword [0x008b6b70]
mov dl, 1
mov r8, rax
call fcn.005f9a40
mov qword [rbx + 0xd0], rax
mov rsi, qword [rbx + 0xd0]
mov rcx, rsi
xor edx, edx
call fcn.006204b0
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006e42b0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xd0]
call fcn.00602ce0
mov rdi, rax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call fcn.00767088
mov rcx, qword [rbx + 0xd0]
call fcn.00602ce0
mov rcx, rax
xor edx, edx
call fcn.007670c0
cmp qword [rbx + 0xf0], 0
jne 0x6e4d9a
mov rcx, qword [rbx + 0x10]
call fcn.00602ce0
mov rcx, qword [0x008b6b70]
mov dl, 1
mov r8, rax
call fcn.005f9a40
mov qword [rbx + 0xf0], rax
mov rsi, qword [rbx + 0xf0]
mov rcx, rsi
mov dl, 1
call fcn.006204b0
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006e4310]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xf0]
call fcn.00602ce0
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call fcn.00767088
mov rcx, qword [rbx + 0xf0]
call fcn.00602ce0
mov rcx, rax
xor edx, edx
call fcn.007670c0
cmp qword [rbx + 0xe0], 0
jne 0x6e4e42
mov rcx, qword [rbx + 0x10]
call fcn.00602ce0
mov rcx, qword [0x008b91f0]
mov dl, 1
mov r8, rax
call fcn.005f9a40
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov byte [rsi + 0x4a8], 1
mov rcx, qword [rbx + 0xe0]
call fcn.00602ce0
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov r13d, eax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call fcn.00767088
mov rcx, qword [rbx + 0xe0]
call fcn.00602ce0
mov rcx, rax
xor edx, edx
call fcn.007670c0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x6ed9b0
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x01098a50]
mov eax, ecx
mov r8d, 8
mov r9d, eax
and r9d, 1
test r9b, r9b
je 0x6ed9d8
shr eax, 1
xor eax, 0xedb88320
jmp 0x6ed9db
shr eax, 1
sub r8d, 1
test r8d, r8d
jne 0x6ed9c1
nop
mov dword [rdx], eax
add ecx, 1
add rdx, 4
cmp ecx, 0x100
jne 0x6ed9b9
nop
mov byte [0x01098e50], 1
ret
Function at 0x6eda00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov esi, r8d
mov edi, ecx
cmp byte [0x01098e50], 0
jne 0x6eda1d
call fcn.006ed9b0
xor ecx, ecx
mov edx, esi
sub edx, 1
mov eax, ecx
cmp eax, edx
jg 0x6eda63
sub edx, ecx
add edx, 1
lea rcx, [0x01098a50]
movsxd r8, eax
movzx r8, byte [rbx + r8]
mov r9d, edi
xor r9d, r8d
and r9d, 0xff
mov r9d, r9d
shr edi, 8
mov ecx, dword [rcx + r9*4]
xor ecx, edi
mov edi, ecx
add eax, 1
sub edx, 1
test edx, edx
jne 0x6eda2f
nop
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x7290d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
test rsi, rsi
je 0x729212
test rbx, rbx
je 0x729212
test r15, r15
je 0x729212
lea rcx, [0x00953d70]
call fcn.00766210
mov rdi, rax
test rdi, rdi
je 0x729212
mov r13, qword [rbp + 0x78]
mov r12, qword [rbp + 0x70]
lea rdx, [0x00953d79]
mov rcx, rdi
call fcn.00766238
mov qword [rsi], rax
lea rdx, [0x00953d92]
mov rcx, rdi
call fcn.00766238
mov qword [rbx], rax
lea rdx, [0x00953dad]
mov rcx, rdi
call fcn.00766238
mov qword [r15], rax
lea rdx, [0x00953dcc]
mov rcx, rdi
call fcn.00766238
mov qword [r14], rax
lea rdx, [0x00953de7]
mov rcx, rdi
call fcn.00766238
mov qword [r12], rax
lea rdx, [0x00953e15]
mov rcx, rdi
call fcn.00766238
mov qword [r13], rax
mov rax, qword [rsi]
mov qword [0x01099c30], rax
cmp qword [r14], 0
je 0x7291ee
cmp qword [r12], 0
jne 0x7291bc
lea rax, [0x00729080]
mov qword [r12], rax
mov rcx, qword [r13]
test rcx, rcx
je 0x729201
cmp qword [rsi], 0
je 0x729212
cmp qword [rbx], 0
je 0x729212
cmp qword [r15], 0
je 0x729212
cmp qword [r14], 0
je 0x729212
cmp qword [r12], 0
je 0x729212
xor eax, eax
test rcx, rcx
setne al
jmp 0x729214
lea rax, [0x00729090]
mov qword [r14], rax
cmp qword [r12], 0
jne 0x7291bc
jmp 0x7291b1
lea rcx, [0x00729080]
mov qword [r13], rcx
cmp qword [rsi], 0
jne 0x7291cb
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x72ae20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call fcn.007661a8
mov ecx, eax
cmp ecx, 0xffffffff
je 0x72ae5d
xor eax, eax
test sil, 2
je 0x72ae56
and ecx, 1
je 0x72ae56
call fcn.0073cdc0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.0072d770
jmp 0x72ae20
Function at 0x72b250
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
call fcn.0072cc10
test bh, 0xc0
jne 0x72b286
mov rax, qword [0x00989520]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x72b2b1
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x00953f60]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x72b2d6
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x00984cf0]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x72b2e6
mov rcx, r14
call fcn.007661a8
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x72b2ff
cmp al, 2
je 0x72b306
cmp al, 1
jne 0x72b3e6
mov edx, 0x40000000
jmp 0x72b30b
mov edx, 0x80000000
jmp 0x72b30b
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call fcn.00766010
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x72b3c6
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov ecx, esi
call fcn.0072b190
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov ecx, esi
call fcn.0072ce00
mov edi, eax
cmp edi, 0xffffffff
jne 0x72b3f2
mov ecx, 4
call fcn.0072d6b0
mov rcx, rsi
call fcn.00765fd8
mov edi, 0xffffffff
jmp 0x72b3f2
call fcn.007661d8
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x72b3eb
mov ecx, 1
call fcn.0072d6b0
mov edi, eax
call fcn.0072cc70
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x72b630
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov ebx, edx
mov r14, rcx
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], r8
call fcn.0072cc10
test bh, 0xc0
jne 0x72b666
mov rax, qword [0x00989520]
mov ecx, 0xc000
and ecx, dword [rax]
or ebx, ecx
mov eax, ebx
and eax, 0x700
add eax, 0xffffff00
shr eax, 8
mov edi, 3
cmp eax, 6
ja 0x72b691
shl rax, 0x28
sar rax, 0x28
lea rcx, [0x00953f80]
mov edi, dword [rcx + rax*4]
test bh, 1
je 0x72b6b6
lea rax, [rbp + 0x48]
mov qword [rbp - 0x18], rax
mov al, byte [0x00984cf0]
and al, byte [rbp + 0x40]
mov eax, 0x80
mov ecx, 1
cmovs ecx, eax
jmp 0x72b6c6
mov rcx, r14
call fcn.007661b0
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, ebx
and al, 3
je 0x72b6df
cmp al, 2
je 0x72b6e6
cmp al, 1
jne 0x72b7c6
mov edx, 0x40000000
jmp 0x72b6eb
mov edx, 0x80000000
jmp 0x72b6eb
mov edx, 0xc0000000
mov eax, ebx
and eax, 0x70
add eax, 0xfffffff0
shr eax, 4
cmp eax, 3
mov esi, 3
cmovb esi, eax
xor r8d, r8d
cmp edx, 0x80000000
sete r8b
test bl, 4
cmove r8d, esi
mov dword [rbp - 0x18], 0x18
mov qword [rbp - 0x10], 0
mov eax, ebx
shr eax, 7
not eax
and eax, 1
mov dword [rbp - 8], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x30], 0
lea r9, [rbp - 0x18]
mov rcx, r14
call fcn.00766018
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x72b7a6
mov edi, ebx
shr edi, 1
not edi
and edi, 0x4000
or edi, ebx
mov ecx, esi
call fcn.0072b190
mov edx, edi
or edx, 0x2000
test eax, eax
cmove edx, edi
and edx, 0xfffff8ff
mov ecx, esi
call fcn.0072ce00
mov edi, eax
cmp edi, 0xffffffff
jne 0x72b7d2
mov ecx, 4
call fcn.0072d6b0
mov rcx, rsi
call fcn.00765fd8
mov edi, 0xffffffff
jmp 0x72b7d2
call fcn.007661d8
movzx eax, ax
test bh, 1
mov edx, 0x50
mov ecx, 2
cmovne ecx, edx
cmp eax, 0x6e
cmovne ecx, eax
jmp 0x72b7cb
mov ecx, 1
call fcn.0072d6b0
mov edi, eax
call fcn.0072cc70
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x72bcb0
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00988d00], ecx
jbe 0x72bcec
movsxd rax, ecx
lea rcx, [0x0109a4b0]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call fcn.00766418
cmp eax, 1
jne 0x72bcfd
mov eax, dword [rbp - 4]
jmp 0x72bcf6
mov ecx, 6
call fcn.0072d6b0
nop
add rsp, 0x30
pop rbp
ret
call fcn.007661d8
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x72bcf6
jmp 0x72bcf1

Function at 0x72bd40
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
cmp dword [0x00988d00], ecx
jbe 0x72bd7c
movsxd rax, ecx
lea rcx, [0x0109a4b0]
movsxd rcx, dword [rcx + rax*4]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 4]
call fcn.00766570
cmp eax, 1
jne 0x72bd88
mov eax, dword [rbp - 4]
jmp 0x72bd8d
mov ecx, 6
call fcn.0072d6b0
jmp 0x72bd8d
call fcn.0072d770
nop
add rsp, 0x30
pop rbp
ret

Function at 0x730500
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call fcn.00766068
cmp eax, 1
jne 0x73051c
xor eax, eax
add rsp, 0x20
pop rbp
ret
add rsp, 0x20
pop rbp
jmp fcn.0072d770
Function at 0x7307a0
Capabilities:
Timestomp file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rdi, rdx
call fcn.0072e0c0
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x7307e7
test rdi, rdi
je 0x7307ee
mov rcx, qword [rdi]
lea rdx, [rbp - 8]
call fcn.00730530
cmp eax, 1
jne 0x730821
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x10]
call fcn.00730530
cmp eax, 1
je 0x73080e
jmp 0x730821
mov ecx, 0xffffffff
jmp 0x73082e
lea rdi, [rbp - 0x20]
mov rcx, rdi
call fcn.007661e0
lea rdx, [rbp - 8]
mov rcx, rdi
call fcn.007664d8
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x10]
mov rcx, rsi
mov r9, rdx
call fcn.00766490
xor ecx, ecx
test eax, eax
jne 0x73082e
call fcn.0072d770
mov ecx, eax
mov eax, ecx
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x733330
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, edx
call fcn.007661a8
mov ecx, eax
cmp ecx, 0xffffffff
je 0x72ae5d
xor eax, eax
test sil, 2
je 0x72ae56
and ecx, 1
je 0x72ae56
call fcn.0073cdc0
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x28
pop rsi
pop rbp
ret
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.0072d770
jmp 0x72ae20
Function at 0x735400
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov r14, rdx
mov r15, rcx
mov ecx, dword [r15 + 4]
lea rbx, [rbp - 0x60]
mov edi, pe_nt_image_headers64
mov edx, 0x1001
mov r9d, pe_nt_image_headers64
mov r8, rbx
call fcn.007661e8
mov rcx, rbx
call fcn.0072ab10
mov word [rbp + rax - 0x60], 0x5f
mov esi, dword [r15 + 4]
mov rcx, rbx
call fcn.0072ab10
lea r8, [rbp + rax - 0x60]
sub edi, eax
mov edx, 0x1002
mov ecx, esi
mov r9d, edi
call fcn.007661e8
mov rcx, rbx
call fcn.0072ab10
mov word [rbp + rax - 0x60], 0x2e
mov esi, dword [r15]
mov rcx, rbx
call fcn.0072ab10
lea rdx, [rbp + rax - 0x60]
mov r8d, 0xa
mov ecx, esi
call fcn.00739900
mov rbx, qword [r15 + 0x38]
test rbx, rbx
je 0x7354e3
mov rcx, rbx
call fcn.0072ab10
mov rsi, rax
mov rcx, r14
call fcn.0072ab10
mov rdi, rax
lea rcx, [rbp - 0x60]
call fcn.0072ab10
add rdi, rsi
lea rdx, [rax + rdi + 3]
mov rcx, rbx
call fcn.00729520
mov rbx, rax
mov qword [r15 + 0x38], rbx
test rbx, rbx
jne 0x735527
jmp 0x73556a
mov rcx, r14
call fcn.0072ab10
mov rsi, rax
lea rcx, [rbp - 0x60]
call fcn.0072ab10
mov rdi, rax
lea rcx, [rsi + rdi + 3]
call fcn.00729500
mov rbx, rax
mov qword [r15 + 0x38], rbx
test rbx, rbx
je 0x73556a
mov rcx, r14
call fcn.0072ab10
lea r8, [rdi + rax + 3]
xor edx, edx
mov rcx, rbx
call fcn.0072a3d0
mov rcx, rbx
mov rdx, r14
call fcn.0072aba0
mov rsi, qword [r15 + 0x38]
mov rcx, rsi
call fcn.0072ab10
mov word [rsi + rax], 0x3d
mov rcx, qword [r15 + 0x38]
lea rdx, [rbp - 0x60]
call fcn.0072aba0
mov rsi, qword [r15 + 0x38]
mov rcx, rsi
call fcn.0072ab10
mov word [rsi + rax], 0xa
mov eax, 1
jmp 0x73556c
xor eax, eax
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x735580
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov rdi, rdx
mov r12, rcx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x60], 0x656e6f6e
mov dword [rbp + 0xc], 0x303030
mov rcx, rdi
call fcn.007376a0
xor esi, esi
mov r13d, 1
lea r14, [rbp - 0x60]
lea rbx, [rbp + 0xc]
mov r15d, 1
mov qword [rbp + 0x10], rdi
nop word cs:[rax + rax]
mov edi, r15d
and edi, 0xfbff
or edi, 0x400
mov edx, 0x1001
mov r9d, 0x40
mov ecx, edi
mov r8, r14
call fcn.007661e8
mov edx, 3
mov r9d, 4
mov ecx, edi
mov rdi, qword [rbp + 0x10]
mov r8, rbx
call fcn.007661e8
mov rcx, r14
call fcn.007376a0
mov rcx, rbx
call fcn.007376a0
mov rcx, rdi
mov rdx, r14
call fcn.00729e00
test rax, rax
jne 0x7356c7
mov rcx, rbx
call fcn.0072ab10
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.0072a680
xor ecx, ecx
test eax, eax
setne cl
cmove esi, r13d
add r15d, ecx
cmp r15d, 0x38
jg 0x73567f
test esi, esi
je 0x7355f0
test esi, esi
jne 0x7356c7
mov edx, 0x5f
mov rcx, rdi
call fcn.0072acc0
test rax, rax
jne 0x7356ab
mov edx, 0x2e
mov rcx, rdi
call fcn.0072acc0
test rax, rax
je 0x7357d7
mov r15d, dword [r12 + 4]
test r15d, r15d
je 0x7356be
and r15d, 0x3ff
jmp 0x7356c7
call fcn.00766270
movzx r15d, ax
mov edx, 0x5f
mov rcx, rdi
call fcn.0072acc0
test rax, rax
je 0x735785
mov qword [rbp], r12
inc rax
mov edx, 0x2e
mov qword [rbp - 0x10], rax
mov rcx, rax
call fcn.0072acc0
test rax, rax
je 0x7356fd
mov byte [rax], 0
mov qword [rbp - 8], rax
xor ebx, ebx
lea rdi, [rbp - 0x60]
mov r13d, 1
xor r12d, r12d
mov eax, r13d
shl eax, 0xa
or eax, r15d
movzx esi, ax
mov edx, 0x1002
mov r9d, 0x40
mov ecx, esi
mov r8, rdi
call fcn.007661e8
mov r14d, eax
mov rcx, rdi
call fcn.007376a0
mov rcx, rdi
mov rdx, qword [rbp - 0x10]
call fcn.0072ac30
xor ecx, ecx
test eax, eax
setne al
mov edx, 1
cmove r12d, edx
cmove ebx, esi
test r14d, r14d
je 0x73576a
mov cl, al
add r13d, ecx
test r12d, r12d
je 0x735710
test r12d, r12d
je 0x7357d7
mov rax, qword [rbp - 8]
test rax, rax
je 0x73577b
mov byte [rax], 0x2e
mov r12, qword [rbp]
mov rdi, qword [rbp + 0x10]
jmp 0x735796
and r15d, 0xfbff
or r15d, 0x400
mov ebx, r15d
mov edx, 0x2e
mov rcx, rdi
call fcn.0072acc0
mov rsi, rax
test rsi, rsi
je 0x7357b0
inc rsi
jmp 0x7357c9
lea rsi, [rbp - 0x17]
mov edx, 0xb
mov r9d, 7
mov ecx, ebx
mov r8, rsi
call fcn.007661e8
mov rcx, rsi
call fcn.00738ca0
mov dword [r12], eax
jmp 0x7357e3
mov ecx, 0x20000101
call fcn.007664a0
xor ebx, ebx
mov eax, ebx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret