joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140082100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400824e0]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1f4d], 0
jne 0x140006737
cmp byte [rbx + 0x1f4e], 0
jne 0x140006737
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000ae40
test sil, 1
je 0x140006866
jmp 0x1400067cf
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14004d018]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x14004d00c]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
or dword [rbx + 0x1cb0], 1
mov qword [rbx + 0x1cc8], rax
movss dword [rbx + 0x1cc0], xmm0
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mov rax, qword [0x1400824e0]
mulss xmm0, dword [0x14004cfbc]
or dword [rax + 0x1cb0], 0x40
movss dword [rax + 0x1d10], xmm0
mov r9d, dword [rbx + 0x2ff8]
call fcn.14000ae40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140006820
lea r11, [0x14004c7d0]
nop
cmp r9b, 0x23
jne 0x140006803
cmp byte [r8], r9b
jne 0x140006803
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400067f0
not ecx
call fcn.140009a50
test rax, rax
je 0x140006866
cmp byte [rax + 0x8e], 0
je 0x140006866
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.14000ae40
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140003b50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140049c80
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009ad0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140009b20
lea r11, [0x14004c7d0]
cmp r9b, 0x23
jne 0x140009b03
cmp byte [r8], r9b
jne 0x140009b03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140009af0
not ecx
jmp fcn.140009a50

Function at 0x14000a470
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0xc8]
mov r9, r8
mov r8, qword [rcx + 0xd0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.14000af90
Function at 0x14002bb40
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140082100]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000a4a0
mov rcx, qword [0x140082558]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov rdi, rax
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x140082560]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140082568]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x140082560], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x138], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x139], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13b], 0
mov byte [rdi + 0x13a], al
call fcn.14000a4a0
mov rbx, rax
cmp byte [rax + 0x393], 0
je 0x14002bc83
cvttss2si ecx, dword [rax + 0x120]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ecx
cvttss2si ecx, dword [rax + 0x124]
mov dword [rsp + 0x3c], ecx
mov rcx, qword [0x140082558]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14002bc83
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x120], 0xff7fffff
mov dword [rbx + 0x124], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140082558]
jne 0x14002bced
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14002bced
mov rcx, qword [0x140082558]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14002bced
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x120], xmm0
movss dword [rbx + 0x124], xmm1
cmp byte [rdi + 0xc0], 0
je 0x14002bcfd
mov eax, 0xffffffff
jmp 0x14002bd02
call fcn.14000a4b0
cmp dword [0x14005b1c0], eax
je 0x14002bd15
mov dword [0x14005b1c0], eax
call fcn.14002c0a0
call fcn.14002bda0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140049c80
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14002fb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140082100]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14002fb90
cmp al, 0x25
jne 0x14002fb84
cmp byte [r8 + 1], al
jne 0x14002fb90
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14002fb77
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14002fcfa
cmp byte [r8 + 1], dl
je 0x14002fcfa
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14002fbcd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14002fbf5
sub dl, 0x61
cmp dl, 0x19
ja 0x14002fbe7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14002fbf5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14002fbb0
jmp 0x14002fbf8
inc r9
cmp r8, r9
jae 0x14002fc2f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14002fc24
bt rdx, rax
jb 0x14002fc2a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14002fc10
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14000ae40
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14002fc68
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14002fc60
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14002fce8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14002fc8a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x14002fc98
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x14002fcd6
movss xmm2, dword [0x14004d010]
nop
cmp al, 0x39
ja 0x14002fcd6
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14002fcb0
cmp r9b, 0x2d
jne 0x14002fcf5
xorps xmm1, xmmword [0x14004d080]
movaps xmm0, xmm1
jmp 0x14002fcfd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14002fcfd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140049c80
add rsp, 0x90
pop rbx
ret
Function at 0x14002fd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140082100]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14002fd60
cmp al, 0x25
jne 0x14002fd54
cmp byte [r8 + 1], al
jne 0x14002fd60
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14002fd47
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14002fec4
cmp byte [r8 + 1], dl
je 0x14002fec4
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14002fd9d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14002fdc5
sub dl, 0x61
cmp dl, 0x19
ja 0x14002fdb7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14002fdc5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14002fd80
jmp 0x14002fdc8
inc r9
cmp r8, r9
jae 0x14002fdff
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14002fdf4
bt rdx, rax
jb 0x14002fdfa
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14002fde0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.14000ae40
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14002fe38
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14002fe30
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14002feb6
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14002fe5a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x14002fe68
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x14002fea4
movsd xmm2, qword [0x1400513f8]
nop
cmp al, 0x39
ja 0x14002fea4
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14002fe80
cmp r9b, 0x2d
jne 0x14002febf
xorps xmm1, xmmword [0x140051480]
movaps xmm0, xmm1
jmp 0x14002fec7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14002fec7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140049c80
add rsp, 0x90
pop rbx
ret
Function at 0x14004a88c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a8d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a8d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a8d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a8d6
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a8d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004a8d8
xor al, al
add rsp, 0x28
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ed0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014220
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014240
xor al, al
jmp 0x1400142c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014253
xor al, al
jmp 0x1400142c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001427d
xor al, al
jmp 0x1400142c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014291
xor al, al
jmp 0x1400142c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400142a3
xor al, al
jmp 0x1400142c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142bf
xor al, al
jmp 0x1400142c1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001140b
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140016740
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x140033080]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x14003a0ff]
call fcn.1400118ca
mov qword [rbp + 8], 0
mov edx, dword [rbp + 0x700]
mov ecx, 0x18
call fcn.14001142e
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400167fc
mov dword [rbp + 0x50], 0x438
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14001159b
test eax, eax
je 0x1400167fc
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14001114a
test eax, eax
je 0x1400167fc
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400167fa
mov rax, qword [rbp + 0x68]
mov qword [rbp + 8], rax
jmp 0x1400167fc
jmp 0x1400167c7
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002aeb0]
call fcn.140011771
mov rax, rdi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret

Function at 0x1400114e2
Capabilities:
Terminate process

Disassembly:
jmp 0x140023060
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011636
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021f10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021f30
xor al, al
jmp 0x140021fb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021f43
xor al, al
jmp 0x140021fb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140021f6d
xor al, al
jmp 0x140021fb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140021f81
xor al, al
jmp 0x140021fb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021f93
xor al, al
jmp 0x140021fb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140021faf
xor al, al
jmp 0x140021fb1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400118a7
Capabilities:
Terminate process

Disassembly:
jmp 0x140017f10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x248]
mov rax, qword [0x140033080]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x14003a1db]
call fcn.1400118ca
mov rcx, qword [rbp + 0x220]
call fcn.140017a90
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140017f7c
xor eax, eax
jmp 0x1400180fa
mov rax, qword [rbp + 8]
add rax, 4
mov r8d, 4
mov rdx, rax
lea rcx, [rbp + 0xc4]
call fcn.140011398
cmp qword [rbp + 0x228], 0
je 0x140017fd9
mov r8d, 8
mov rdx, qword [rbp + 0x228]
lea rcx, [rbp + 0x28]
call fcn.140011398
mov rax, qword [rbp + 0x28]
shr rax, 8
and rax, 0x7fffffff
mov ecx, dword [rbp + 0xc4]
xor rcx, rax
mov rax, rcx
mov dword [rbp + 0xc4], eax
mov rax, qword [0x140033590]
add rax, 0x7e17f0
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140011398
mov r8d, 4
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x104]
call fcn.140011398
cmp dword [rbp + 0x104], 0
jne 0x140018022
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 0x48]
add rax, 8
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140011398
xor edx, edx
mov eax, dword [rbp + 0xc4]
div dword [rbp + 0x104]
mov eax, edx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
shl eax, 3
mov eax, eax
mov rcx, qword [rbp + 0x68]
add rcx, rax
mov rax, rcx
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140011398
cmp qword [rbp + 0x88], 0
je 0x1400180f8
mov r8d, 4
mov rdx, qword [rbp + 0x88]
lea rcx, [rbp + 0x124]
call fcn.140011398
mov eax, dword [rbp + 0xc4]
cmp dword [rbp + 0x124], eax
jne 0x1400180d6
mov rax, qword [rbp + 0x88]
add rax, 0x10
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140011398
mov rax, qword [rbp + 0xa8]
jmp 0x1400180fa
mov rax, qword [rbp + 0x88]
add rax, 8
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140011398
jmp 0x14001807c
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b4e0]
call fcn.140011771
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret
Function at 0x140017a90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x140033080]
xor rax, rbp
mov qword [rbp + 0x220], rax
lea rcx, [0x14003a1db]
call fcn.1400118ca
mov rax, qword [0x140033590]
add rax, 0x7fd7f0
mov r8d, 4
mov rdx, rax
lea rcx, [rbp + 4]
call fcn.140011398
cmp dword [rbp + 4], 0
je 0x140017b09
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
mov rcx, qword [rbp + 0x250]
call fcn.140017dd0
mov dword [rbp + 0x44], eax
mov rax, qword [0x140033590]
add rax, 0x7e17b8
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140011398
mov r8d, 4
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x84]
call fcn.140011398
mov rax, qword [rbp + 0x68]
add rax, 8
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140011398
cmp dword [rbp + 0x84], 0
jne 0x140017b7e
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
xor edx, edx
mov eax, dword [rbp + 0x44]
div dword [rbp + 0x84]
mov eax, edx
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
shl eax, 3
cdqe
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.140011398
cmp qword [rbp + 0xc8], 0
je 0x140017cf0
mov r8d, 4
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0xe4]
call fcn.140011398
mov eax, dword [rbp + 0x44]
cmp dword [rbp + 0xe4], eax
jne 0x140017ccb
mov rax, qword [rbp + 0xc8]
add rax, 0x10
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140011398
mov r8d, 2
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x124]
call fcn.140011398
movzx eax, word [rbp + 0x124]
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x250]
call fcn.1400113ed
mov rcx, qword [rbp + 0x218]
cmp rcx, rax
jne 0x140017ccb
movzx eax, word [rbp + 0x124]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x148], rax
movzx eax, word [rbp + 0x124]
mov rcx, qword [rbp + 0x108]
add rcx, 8
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rbp + 0x148]
call fcn.140011398
movzx eax, word [rbp + 0x124]
mov r8d, eax
mov rdx, qword [rbp + 0x250]
mov rcx, qword [rbp + 0x148]
call fcn.14001136b
test eax, eax
jne 0x140017cbe
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_free]
mov rax, qword [rbp + 0x108]
jmp 0x140017cf2
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_free]
mov rax, qword [rbp + 0xc8]
add rax, 8
mov r8d, 8
mov rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.140011398
jmp 0x140017bb8
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002db30]
call fcn.140011771
mov rax, rdi
mov rcx, qword [rbp + 0x220]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ca14
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ca14
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f340
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a348
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d6f0
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a348
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b0dc
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ca14
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018804
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ca14
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x181b5c000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x181b5c00a
jmp 0x181b5e00f
jmp fcn.1816aa0b0