joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140622058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406221df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140622089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14062206f
add dl, dl
jne 0x140622096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406220f6
xor eax, eax
add dl, dl
jne 0x1406220a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406221ad
add dl, dl
jne 0x1406220b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406220c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406220d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406220dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406220ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14062207e
mov eax, 1
add dl, dl
jne 0x140622106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140622113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406220fb
sub eax, ebx
mov ebx, 1
jne 0x14062214c
mov ecx, 1
add dl, dl
jne 0x14062212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14062213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140622123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140622168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140622175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14062215d
cmp eax, 0x7d00
jae 0x14062219b
cmp eax, 0x500
jb 0x140622196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062207e
cmp eax, 0x7f
ja 0x14062219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14062207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406221d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14062207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001078
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x180065018]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
mov r11, rcx
mov r10, qword [rsp + 0x88]
shl eax, 0x18
mov dword [rsp + 0x38], eax
movzx eax, word [rdx + 1]
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [r10], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], r10
movzx ecx, word [rax]
mov dword [r10 + 8], ecx
lea rcx, str.ETW0
mov qword [r10 + 0x10], rdx
mov dword [r10 + 0xc], 2
movzx eax, word [rdx]
lea rdx, [rsp + 0x38]
mov dword [r10 + 0x18], eax
lea rax, [0x18005ba2d]
sub eax, ecx
mov dword [r10 + 0x1c], 1
mov rcx, qword [r11 + 0x20]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180039210
add rsp, 0x58
ret

Function at 0x180003e78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movaps xmm1, xmmword [rcx]
movaps xmm0, xmmword [rdx]
movq r14, xmm1
movq rsi, xmm0
psrldq xmm1, 8
psrldq xmm0, 8
movq rax, xmm0
lea r13, [rsi + rax*2]
movq rax, xmm1
lea rbp, [r14 + rax*2]
mov rax, r13
sub rax, rsi
mov rcx, rbp
sub rcx, r14
xor rcx, rax
test rcx, 0xfffffffffffffffe
jne 0x180003f66
mov r15, r14
cmp r14, rbp
je 0x180003f15
mov r12, rsi
sub r12, r14
movzx ecx, word [r15]
movzx ebx, word [r12 + r15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, bx
movzx edi, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx eax, ax
cmp edi, eax
jne 0x180003f66
add r15, 2
cmp r15, rbp
jne 0x180003eea
xor eax, eax
jmp 0x180003f81
cmp rsi, r13
je 0x180003f6d
movzx ecx, word [r14]
movzx ebx, word [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, bx
movzx edi, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx eax, ax
cmp edi, eax
js 0x180003f77
movzx ecx, word [rsi]
movzx ebx, word [r14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, bx
movzx edi, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx eax, ax
cmp edi, eax
js 0x180003f7c
add r14, 2
add rsi, 2
cmp r14, rbp
jne 0x180003f19
jmp 0x180003f72
cmp r14, rbp
jne 0x180003f7c
cmp rsi, r13
je 0x180003f7c
or eax, 0xffffffff
jmp 0x180003f81
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000f880
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r14b, r9b
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x29], rdx
add rcx, 0x58
call fcn.18000fa0c
lea rax, str.Instantiating_class___.
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], 0x19
movups xmm0, xmmword [rbx]
movq rcx, xmm0
psrldq xmm0, 8
mov qword [rbp - 0x29], rcx
movq qword [rbp - 0x21], xmm0
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp + 7], xmm0
mov qword [rbp - 0x29], 0xd
lea rax, [rbp + 7]
mov qword [rbp - 0x21], rax
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
movaps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm1
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.18002a13c
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x18005879c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x18000f970
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f96b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000f96b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180001480
movups xmm0, xmmword [rbx]
movdqu xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x17]
call fcn.180036878
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x18000f992
mov rbx, qword [rax]
mov ecx, 0x18
call fcn.180039230
mov qword [rbp - 0x29], rax
lea r9, [rsi + 0x30]
mov byte [rsp + 0x20], r14b
mov r8, rbx
mov rdx, qword [rsi + 0x88]
mov rcx, rax
call fcn.18000e434
nop
mov qword [rdi], rax
lea rcx, [rbp + 0x17]
call fcn.18000380c
mov rax, rdi
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180016ac0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180065018]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
lea rax, str.Destroying_class___.
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x16
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8, qword [rcx + 8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000ef84
cmp qword [rax + 0x18], 0x10
jb 0x180016b18
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [0x18005879c]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180016b6e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016b69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180001480
mov rdx, qword [rbx + 8]
cmp qword [rdx + 0x18], 0x10
jb 0x180016b7c
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.180028048
nop
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x28]
mov rax, qword [rax + 8]
call qword [0x18004a5c0]
and qword [rbx + 0x28], 0
lea rcx, [rsp + 0x50]
call fcn.1800280f8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180039210
add rsp, 0x80
pop rbx
ret
Function at 0x180029248
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180065018]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8, rcx
mov dword [rbp - 0x69], 0x10001
xor edx, edx
mov dword [rbp - 0x65], 0x20001
mov ecx, 1
mov dword [rbp - 0x61], 0x20002
mov dword [rbp - 0x5d], 0x30003
mov rax, r8
or rax, rcx
mov dword [rbp - 0x59], 0x40003
bsr rax, rax
mov dword [rbp - 0x55], 0x40004
lea r9d, [rcx + 9]
cdqe
mov dword [rbp - 0x51], 0x50004
mov dword [rbp - 0x4d], 0x50005
mov dword [rbp - 0x49], 0x60006
mov dword [rbp - 0x45], 0x70006
mov dword [rbp - 0x41], 0x70007
mov dword [rbp - 0x3d], 0x80007
mov dword [rbp - 0x39], 0x80008
mov dword [rbp - 0x35], 0x90009
mov dword [rbp - 0x31], 0xa0009
mov dword [rbp - 0x2d], 0xa000a
mov dword [rbp - 0x29], 0xb000a
mov dword [rbp - 0x25], 0xb000b
mov dword [rbp - 0x21], 0xc000c
mov dword [rbp - 0x1d], 0xd000c
mov dword [rbp - 0x19], 0xd000d
mov dword [rbp - 0x15], 0xe000d
mov dword [rbp - 0x11], 0xe000e
mov dword [rbp - 0xd], 0xf000f
mov dword [rbp - 9], 0x10000f
mov dword [rbp - 5], 0x100010
mov dword [rbp - 1], 0x110010
mov dword [rbp + 3], 0x110011
mov dword [rbp + 7], 0x120012
mov dword [rbp + 0xb], 0x130012
mov dword [rbp + 0xf], 0x130013
mov dword [rbp + 0x13], 0x140013
movzx ecx, word [rbp + rax*2 - 0x69]
movabs rax, 0x2540be400
mov qword [rbp - 0x11], rax
movabs rax, 0x174876e800
mov qword [rbp - 9], rax
movabs rax, 0xe8d4a51000
mov qword [rbp - 1], rax
movabs rax, 0x9184e72a000
mov qword [rbp + 7], rax
movabs rax, 0x5af3107a4000
mov qword [rbp + 0xf], rax
movabs rax, 0x38d7ea4c68000
mov qword [rbp + 0x17], rax
movabs rax, 0x2386f26fc10000
mov qword [rbp + 0x1f], rax
movabs rax, 0x16345785d8a0000
mov qword [rbp + 0x27], rax
movabs rax, 0xde0b6b3a7640000
mov qword [rbp + 0x2f], rax
movabs rax, 0x8ac7230489e80000
mov qword [rbp + 0x37], rax
mov eax, ecx
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x61], rdx
mov qword [rbp - 0x59], r9
mov qword [rbp - 0x51], 0x64
mov qword [rbp - 0x49], 0x3e8
mov qword [rbp - 0x41], 0x2710
mov qword [rbp - 0x39], 0x186a0
mov qword [rbp - 0x31], 0xf4240
mov qword [rbp - 0x29], 0x989680
mov qword [rbp - 0x21], 0x5f5e100
mov qword [rbp - 0x19], 0x3b9aca00
cmp r8, qword [rbp + rcx*8 - 0x69]
setb dl
sub eax, edx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180039210
add rsp, 0xd0
pop rbp
ret
Function at 0x180035e70
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rdx + 0x18]
lea rsi, [rdx + 0x10]
mov rdi, qword [rsi]
mov rbx, rdx
mov rdx, qword [rdx + 0x18]
xor r12d, r12d
mov r15, rcx
cmp rdx, rdi
ja 0x180035ec0
mov rax, rbx
cmp rdx, 8
jb 0x180035eb6
mov rax, qword [rbx]
mov qword [rsi], rdx
mov word [rax + rdx*2], r12w
jmp 0x180035ed1
lfence
xor r8d, r8d
sub rdx, rdi
mov rcx, rbx
call fcn.180001d9c
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x180035ede
mov rdx, qword [rbx]
mov r8d, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
jne 0x180035f27
mov rax, qword [rsi]
cmp rdi, rax
ja 0x180035f0c
cmp qword [rbx + 0x18], 8
jb 0x180035f02
mov rbx, qword [rbx]
mov qword [rsi], rdi
mov word [rbx + rdi*2], r12w
jmp 0x180035f20
lfence
sub rdi, rax
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.180001d9c
xor al, al
jmp 0x180035fb7
cmp ebp, r14d
jbe 0x180035f83
lfence
mov rax, qword [rsi]
mov rdx, rbp
cmp rbp, rax
ja 0x180035f54
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x180035f4a
lfence
mov rax, qword [rbx]
mov qword [rsi], rdx
mov word [rax + rbp*2], r12w
jmp 0x180035f65
lfence
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.180001d9c
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x180035f75
lfence
mov rdx, qword [rbx]
mov r8d, ebp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsi]
mov edx, ebp
cmp rdx, rax
ja 0x180035fa4
cmp qword [rbx + 0x18], 8
jb 0x180035f9a
lfence
mov rbx, qword [rbx]
mov qword [rsi], rdx
mov word [rbx + rdx*2], r12w
jmp 0x180035fb5
lfence
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.180001d9c
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800379e8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180065018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180037a28
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x180037a79
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov r9d, r8d
neg r9
and r9, rbx
lea ecx, [r8 - 1]
mov eax, ecx
and ecx, ebx
and eax, edi
dec ecx
add eax, r8d
add eax, ecx
div r8d
xor edx, edx
mov ecx, eax
mov rax, rdi
div r8
add ecx, eax
je 0x180037a79
lock or dword [r9], 0
add r9, r8
add ecx, 0xffffffff
jne 0x180037a6c
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180039210
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x180037a9c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x18000003c]
lea rbx, [0x180000000]
add r8, rbx
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x180037b1a
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x180037b1a
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add rcx, rax
mov r10d, dword [r9 + rbx + 0xc]
xor edx, edx
test r11d, r11d
je 0x180037b1a
mov r9d, dword [rcx + 0xc]
cmp r10d, r9d
jb 0x180037b0f
mov r8d, dword [rcx + 8]
lea eax, [r9 + r8]
cmp r10d, eax
jb 0x180037b35
inc edx
add rcx, 0x28
cmp edx, r11d
jb 0x180037af9
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdi, r9
add rdi, rbx
je 0x180037b1a
cmp dword [0x1800674e8], 0
jne 0x180037b6d
cmp dword [rcx + 0x24], 0
mov dword [0x1800674e8], 1
jl 0x180037b5d
mov ecx, 0x19
int 0x29
mov rdx, r8
mov rcx, rdi
mov rbx, r8
call fcn.1800379e8
jmp 0x180037b70
mov rbx, r8
mov r9, rsi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180037b20
lea ecx, [rax + 0x19]
int 0x29
jmp 0x180037b20
Function at 0x140005d98
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000c030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000348c
xor ebx, ebx
cmp qword [0x14000df10], rbx
mov rdi, rax
jne 0x140005eab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140005f82
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005f82
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000df10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000df18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000df20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000df30], rax
test rax, rax
je 0x140005ea2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000df28], rax
jmp 0x140005eb2
mov rax, qword [0x14000df28]
jmp 0x140005eb9
mov rax, qword [0x14000df28]
mov r11, qword [0x14000df30]
cmp rax, rdi
je 0x140005f20
cmp r11, rdi
je 0x140005f20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000df30]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005f20
test rax, rax
je 0x140005f20
call rsi
test rax, rax
je 0x140005f1a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140005f1a
test byte [rsp + 0x40], 1
jne 0x140005f20
bts ebp, 0x15
jmp 0x140005f60
mov rcx, qword [0x14000df18]
cmp rcx, rdi
je 0x140005f60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005f60
call rax
mov rbx, rax
test rax, rax
je 0x140005f60
mov rcx, qword [0x14000df20]
cmp rcx, rdi
je 0x140005f60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005f60
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000df10]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005f82
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140005f84
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002680
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400247a0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400245cc
Function at 0x1400032a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400032fd
lea rbx, [0x1400d0d30]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400032e4
cmp r10, 2
jb 0x1400032e4
cmp byte [r9], r8b
jne 0x1400032e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400032c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000333f
lea rbx, [0x1400d0d30]
cmp r8b, 0x23
jne 0x140003323
cmp byte [r9], r8b
jne 0x140003323
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003310
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003500
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000352f
mov r8d, 0x7bc
lea rdx, str.C:UsersPetroDesktopSBAGGYimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000353b
mov qword [rdi], 0
lea rdx, [0x1400d0558]
mov rcx, rbx
call fcn.140003350
mov rbx, rax
test rax, rax
jne 0x14000355d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003634
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003634
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003634
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003634
cmp rsi, 0xffffffffffffffff
je 0x140003634
mov rax, qword [0x14013b368]
test rax, rax
je 0x1400035d1
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003634
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003621
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14013b368]
test rax, rax
je 0x140003616
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000363d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000362f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000363f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006db0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x140006dec
mov r8d, 0x70b
lea rdx, [0x1400cb840]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1400d0d30]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f38], ebx
jne 0x140006e67
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001ccb0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400159d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14013b368]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140015a22
cmp byte [rbx + 0x4a76], 0
jne 0x140015a22
movsx r9d, word [rbx + 0x5b82]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003220
test dil, 1
je 0x140015b4f
jmp 0x140015aab
movss xmm1, dword [rbx + 0x38bc]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400d8498]
xor eax, eax
mulss xmm1, dword [0x1400d8488]
addss xmm0, dword [rbx + 0xe08]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47e0], rax
mov dword [rbx + 0x47cc], 1
movss dword [rbx + 0x47d8], xmm0
movss dword [rbx + 0x47dc], xmm1
movss xmm0, dword [rbx + 0x3924]
mulss xmm0, dword [0x1400d83d0]
or dword [rbx + 0x47c8], 0x41
movss dword [rbx + 0x4828], xmm0
movsx r9d, word [rbx + 0x5b82]
call fcn.140003220
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140015b00
lea r11, [0x1400d0d30]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140015ae3
cmp byte [r8], r9b
jne 0x140015ae3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140015ad0
not ecx
call fcn.14000ac30
test rax, rax
je 0x140015b4f
cmp byte [rax + 0xb6], 0
je 0x140015b4f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b82]
movsx r9d, word [rbx + 0x5b82]
call fcn.140003220
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d730
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret