joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a6610
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007c3ab8]
cmp byte [rax + 0x131], 0
jne 0x6a66b3
cmp qword [0x007c3af0], 0
jne 0x6a6656
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x007ab350]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007c3af0], rax
cmp qword [0x007c3ae8], 0
jne 0x6a6678
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007c3ae8], rax
cmp qword [0x007c3af8], 0
jne 0x6a66b3
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x007ab348]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x007c3af8], rax
add rsp, 0x48
ret

Function at 0x6a7780
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2a8], 0
je 0x6a786b
cmp dword [rbx + 0x100], 0
jne 0x6a7861
mov rax, qword [rbx + 0x2a8]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006a7660]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0xf8]
cmp dword [rax + 0x10], 0
je 0x6a7861
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6a780f
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0xf8]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6a7860
mov rcx, qword [rbx + 0xf8]
mov edx, esi
call fcn.004ff810
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6a7820
nop
lea rax, [rbx + 0x100]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6a7b80
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007c3ab8]
cmp qword [rax + 0x2a8], 0
je 0x6a7d46
test sil, sil
jne 0x6a7c68
cmp dword [rbx + 0x110], 0
jne 0x6a7c59
mov rcx, rbx
call fcn.006ac180
lea rcx, [0x006a7a50]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0x88], 0
je 0x6a7c1b
mov rax, qword [0x007c3ab8]
cmp byte [rax + 0x16b], 0
je 0x6a7c1b
mov rcx, qword [rbx + 0x178]
call fcn.00410a40
mov rdi, rax
test edi, edi
jl 0x6a7c1a
mov rax, qword [rbx + 0x178]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a7bfc
nop
mov rax, qword [rbx + 0x108]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a7c58
mov rcx, qword [rbx + 0x108]
mov edx, edi
call fcn.004ff810
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a7c2c
nop
lea rax, [rbx + 0x110]
add dword [rax], 1
jmp 0x6a7d46
cmp dword [rbx + 0x110], 0
jle 0x6a7d46
lea rax, [rbx + 0x110]
sub dword [rax], 1
cmp dword [rbx + 0x110], 0
jne 0x6a7d46
cmp qword [rbx + 0x88], 0
je 0x6a7cdb
mov rax, qword [0x007c3ab8]
cmp byte [rax + 0x16b], 0
je 0x6a7cdb
mov rcx, qword [rbx + 0x178]
call fcn.00410a40
mov rdi, rax
test edi, edi
jl 0x6a7cda
mov rax, qword [rbx + 0x178]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a7cb9
nop
mov rax, qword [rbx + 0x108]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a7d18
mov rcx, qword [rbx + 0x108]
mov edx, edi
call fcn.004ff810
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a7cec
nop
mov rax, qword [rbx + 0x108]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x178]
mov rdx, qword [0x00691ff8]
mov r8d, 1
xor r9, r9
call fcn.00410dd0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6a8f40
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x130], 0
je 0x6a8fae
cmp byte [rbx + 0x16b], 0
jne 0x6a8fae
mov rcx, qword [rbx + 0x2a8]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040dc30
mov rax, qword [rsi]
xor rcx, rcx
test rax, rax
je 0x6a8f99
mov ecx, dword [rax - 4]
test ecx, ecx
jne 0x6a8fbd
mov rcx, rsi
mov rdx, qword [rbx + 0xf0]
call fcn.0040dfc0
jmp 0x6a8fbd
mov rcx, rsi
mov rdx, qword [rbx + 0xf0]
call fcn.0040dfc0
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6ac580
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov byte [rbp + 0x2f], dl
mov qword [rbp + 0x38], 0
nop
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
cmp al, byte [rcx + 0x16b]
je 0x6ac7cb
movzx rax, byte [rbp + 0x2f]
mov rcx, qword [rbp + 0x20]
mov byte [rcx + 0x16b], al
mov rax, qword [rbp + 0x20]
cmp qword [rax + 0x88], 0
je 0x6ac704
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005d2720
test al, al
je 0x6ac704
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6ac704
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6ac704
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6ac66b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
xor r8, r8
call fcn.006966f0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005d2110
mov rcx, rax
mov dl, 1
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.006966f0
jmp 0x6ac6e8
call sub.user32.dll_GetForegroundWindow
mov rbx, rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005d2110
cmp rbx, rax
sete bl
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005d2110
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x88]
movzx r8, byte [rax + 0x99]
call fcn.006966f0
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
mov dl, 1
mov r8b, 1
call fcn.006966f0
test bl, bl
je 0x6ac6e8
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
call fcn.005d2110
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x88]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005c5b40
movzx rax, byte [rbp + 0x2f]
test al, al
je 0x6ac75d
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
or rax, 0x80
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax + 0x2a8]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6ac7cb
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x2a8]
mov ecx, 0xffffffec
mov edx, ecx
mov rcx, rax
call sub.user32.dll_GetWindowLongPtrW
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x2a8]
mov edx, 0xffffffec
and rax, 0xffffffffffffff7f
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rax, qword [rbp + 0x20]
mov rbx, qword [rax + 0x2a8]
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 0xf0]
call fcn.0040e040
mov rcx, qword [rbp + 0x38]
call fcn.0040f0f0
mov rcx, rbx
mov rdx, rax
call sub.user32.dll_SetWindowTextW
nop
lea rcx, [rbp + 0x38]
call fcn.0040d970
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret
Function at 0x6b5020
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6b50d6
mov rcx, qword [rbx + 0x10]
call fcn.005d2110
mov rcx, qword [0x005e5448]
mov dl, 1
mov r8, rax
call fcn.005c8d70
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005ed6c0
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006b4690]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005d2110
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005d2110
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6b5181
mov rcx, qword [rbx + 0x10]
call fcn.005d2110
mov rcx, qword [0x005e5448]
mov dl, 1
mov r8, rax
call fcn.005c8d70
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005ed6c0
lea rax, [rsi + 0x498]
mov qword [rax + 8], rbx
lea rcx, [0x006b46f0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005d2110
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005d2110
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6b521d
mov rcx, qword [rbx + 0x10]
call fcn.005d2110
mov rcx, qword [0x005e6408]
mov dl, 1
mov r8, rax
call fcn.005c8d70
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x468], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005d2110
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005d2110
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x71e380
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xca
jne 0x71e3cf
mov rcx, qword [rsp + 0x40]
call fcn.0071f190
mov r11, qword [rsp + 0x40]
cmp dword [r11 + 0x58], 0
je 0x71e3c3
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcf
mov eax, 1
jmp 0x71e519
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcb
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcb
jne 0x71e4d0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
cmp dword [rax + 0x20], 0
je 0x71e4b8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x71e413
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x240]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x71e438
xor eax, eax
jmp 0x71e519
cmp dword [rsp + 0x20], 2
jne 0x71e441
jmp 0x71e4b8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x71e4b3
cmp dword [rsp + 0x20], 3
je 0x71e45b
cmp dword [rsp + 0x20], 1
jne 0x71e4b3
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 8]
add ecx, 1
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0xc]
cmp dword [rcx + 8], eax
jl 0x71e4b3
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x40]
add ecx, dword [rax + 0x1a4]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov dword [rax + 0xc], ecx
jmp 0x71e3f7
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xac]
mov dword [rcx + 0xb4], eax
jmp 0x71e50f
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x71e50f
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov dword [rax + 0x28], 0x14
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rcx, qword [rsp + 0x40]
call fcn.0071e530
add rsp, 0x38
ret
Function at 0x71e530
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x24], 0xcc
je 0x71e576
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x24], 0xcc
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
cmp dword [rax + 0x10], 0
je 0x71e67d
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
cmp dword [rcx + 0xa8], eax
jae 0x71e641
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x10], 0
je 0x71e5f2
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x8c]
mov dword [rcx + 0xc], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xa8]
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x40]
add r8, 0xa8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x228]
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov r11, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
cmp dword [r11 + 0xa8], eax
jne 0x71e63c
xor eax, eax
jmp 0x71e6ab
jmp 0x71e58c
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax + 8]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
mov rcx, qword [rsp + 0x40]
call qword [rax]
mov r11, qword [rsp + 0x40]
mov dword [r11 + 0xa8], 0
jmp 0x71e576
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x5c], 0
je 0x71e692
mov dword [rsp + 0x24], 0xce
jmp 0x71e69a
mov dword [rsp + 0x24], 0xcd
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x24]
mov dword [rcx + 0x24], eax
mov eax, 1
add rsp, 0x38
ret
Function at 0x740930
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r13, rdx
call fcn.007149c0
mov rax, qword [rbx + 0xa0]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x48]
xor rsi, rsi
mov r14d, eax
sub r14d, 1
cmp esi, r14d
jg 0x740b54
add r14d, 1
mov rcx, qword [rbx + 0xa0]
mov edx, esi
call fcn.0058eae0
mov rdi, rax
mov rax, qword [rbx + 0xa0]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x60]
xor r8, r8
mov ecx, 2
cdq
idiv ecx
mov r9, rax
sub r9d, 1
cmp r8d, r9d
jg 0x740b47
add r9d, 1
mov rax, qword [0x007b86d8]
movzx rcx, byte [r13]
mov ecx, dword [rax + rcx*4]
mov r10, qword [0x007b8728]
mov rax, qword [0x007b9270]
movzx r11, byte [r13 + 1]
mov edx, ecx
add edx, dword [rax + r11*4]
mov r11d, pe_nt_image_headers64
mov eax, edx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
mov r10, qword [0x007b8728]
mov rax, qword [0x007b9168]
movzx r11, byte [r13 + 1]
mov edx, ecx
add edx, dword [rax + r11*4]
mov rax, qword [0x007b92a0]
movzx r11, byte [r13 + 3]
add edx, dword [rax + r11*4]
mov r11d, pe_nt_image_headers64
mov eax, edx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
mov r10, qword [0x007b8728]
mov rax, qword [0x007b8ff0]
movzx rdx, byte [r13 + 3]
add ecx, dword [rax + rdx*4]
mov r11d, pe_nt_image_headers64
mov eax, ecx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
mov rax, qword [0x007b86d8]
movzx rcx, byte [r13 + 2]
mov ecx, dword [rax + rcx*4]
mov r10, qword [0x007b8728]
mov rax, qword [0x007b9270]
movzx r11, byte [r13 + 1]
mov edx, ecx
add edx, dword [rax + r11*4]
mov r11d, pe_nt_image_headers64
mov eax, edx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
mov r10, qword [0x007b8728]
mov rax, qword [0x007b9168]
movzx r11, byte [r13 + 1]
mov edx, ecx
add edx, dword [rax + r11*4]
mov rax, qword [0x007b92a0]
movzx r11, byte [r13 + 3]
add edx, dword [rax + r11*4]
mov r11d, pe_nt_image_headers64
mov eax, edx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
mov r10, qword [0x007b8728]
mov rax, qword [0x007b8ff0]
movzx rdx, byte [r13 + 3]
add ecx, dword [rax + rdx*4]
mov r11d, pe_nt_image_headers64
mov eax, ecx
cdq
idiv r11d
movsxd rax, eax
movzx rax, byte [r10 + rax + 0x3ff]
mov byte [rdi], al
add rdi, 1
add r13, 4
add r8d, 1
cmp r8d, r9d
jne 0x7409ae
nop
add esi, 1
cmp esi, r14d
jne 0x74096d
nop
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x74e850
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rbx
sub rsp, 0x128
mov rbp, rsp
mov rbx, rcx
mov rcx, rdx
lea rdx, [rbp + 0x21]
mov r8d, 0xff
call sub.user32.dll_GetWindowTextA
mov rcx, rbx
lea rdx, [rbp + 0x21]
mov r8d, 0xff
call fcn.0040f1c0
cmp qword [rbx], 0
je 0x74e915
jmp 0x74e8b8
lea rcx, [0x0074e930]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f9f0
mov rcx, rbx
mov edx, eax
mov r8d, 1
call fcn.0040f7c0
lea rcx, [0x0074e930]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f9f0
test eax, eax
jg 0x74e891
jmp 0x74e8fb
lea rcx, [0x0074e940]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f9f0
mov rcx, rbx
mov edx, eax
mov r8d, 1
call fcn.0040f7c0
lea rcx, [0x0074e940]
mov rdx, qword [rbx]
mov r8d, 1
call fcn.0040f9f0
test eax, eax
jg 0x74e8d4
mov rax, rbx
lea rsp, [rbp + 0x128]
pop rbx
pop rbp
ret

Function at 0x141fdd0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141fdd237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141fdd0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141fdd0c7
add dl, dl
jne 0x141fdd0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141fdd14e
xor eax, eax
add dl, dl
jne 0x141fdd0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141fdd205
add dl, dl
jne 0x141fdd10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141fdd11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141fdd128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141fdd135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141fdd142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141fdd0d6
mov eax, 1
add dl, dl
jne 0x141fdd15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141fdd16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141fdd153
sub eax, ebx
mov ebx, 1
jne 0x141fdd1a4
mov ecx, 1
add dl, dl
jne 0x141fdd186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141fdd193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141fdd17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141fdd0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141fdd1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141fdd1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141fdd1b5
cmp eax, 0x7d00
jae 0x141fdd1f3
cmp eax, 0x500
jb 0x141fdd1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141fdd0d6
cmp eax, 0x7f
ja 0x141fdd1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141fdd0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141fdd22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141fdd0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x280616be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x280616d6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x2806e1c20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2806350a0
xorps xmm15, xmm15
mov r14, qword [0x2808a1560]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x280616c45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x280616c54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x280616c73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x280616c83
cmp rbx, 0x1000
jae 0x280616c4b
jmp 0x280616ced
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x280616c95
xor edx, edx
jmp 0x280616ce4
mov rcx, qword [0x2806e1c20]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.2806350a0
xorps xmm15, xmm15
mov r14, qword [0x2808a1560]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x280616c79
jmp 0x280616c68
call fcn.280668800
xorps xmm15, xmm15
mov r14, qword [0x2808a1560]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.280639140
lea rax, [0x2807263bb]
mov ebx, 0x18
nop dword [rax]
call fcn.2806399c0
mov rax, qword [rsp + 0x38]
call fcn.280639700
lea rax, [0x280726a25]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.2806399c0
mov rax, qword [rsp + 0x30]
call fcn.280639700
call fcn.280639380
call fcn.2806391a0
lea rax, [0x2807296ef]
mov ebx, 0x21
call fcn.2806376a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.280665080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.280616be0