joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b0460
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6b066d
mov rcx, qword [0x004c60b8]
mov dl, 1
call fcn.00503650
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.00410520
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6b0650
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.005ec850
test al, al
je 0x6b0637
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006b06d8]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00437fe0
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x6b0637
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006b0746]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6b062a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411ea0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6b062a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411ea0
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6b0513
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.005034d0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.00410520
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6b1780
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007f6d30]
cmp byte [rax + 0x159], 0
jne 0x6b181e
cmp qword [0x007f6d68], 0
jne 0x6b17c5
call sub.kernel32.dll_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x007d4648]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007f6d68], rax
cmp qword [0x007f6d60], 0
jne 0x6b17e5
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007f6d60], rax
cmp qword [0x007f6d70], 0
jne 0x6b181e
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x007d4640]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x007f6d70], rax
add rsp, 0x48
ret

Function at 0x6b29c0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2e0]
test rax, rax
je 0x6b2a9f
cmp dword [rbx + 0x128], 0
jne 0x6b2a95
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006b28c0]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6b2a95
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6b2a43
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6b2a94
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004fb690
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6b2a54
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6b2f10
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007f6d30]
cmp qword [rax + 0x2e0], 0
je 0x6b30d4
test sil, sil
jne 0x6b2ffc
cmp dword [rbx + 0x138], 0
jne 0x6b2fed
mov rcx, rbx
call fcn.006b7980
lea rcx, [0x006b2dd0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6b2faf
mov rax, qword [0x007f6d30]
cmp byte [rax + 0x193], 0
je 0x6b2faf
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6b2f89
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6b2fae
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b2f91
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6b2fec
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fb690
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b2fc0
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6b30d4
cmp dword [rbx + 0x138], 0
jle 0x6b30d4
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6b30d4
cmp qword [rbx + 0xa8], 0
je 0x6b3073
mov rax, qword [0x007f6d30]
cmp byte [rax + 0x193], 0
je 0x6b3073
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6b304a
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6b3072
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b3052
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6b30b0
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fb690
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b3084
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x0069b9a8]
call fcn.00415140
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6b43f0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6b445c
cmp byte [rbx + 0x193], 0
jne 0x6b445c
mov rcx, qword [rbx + 0x2e0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00410820
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x6b4447
mov eax, dword [rcx - 4]
test eax, eax
jne 0x6b446b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410b90
jmp 0x6b446b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410b90
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6b7d70
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6b7f35
mov byte [rbx + 0x193], sil
mov rax, qword [rbx + 0xa8]
test rax, rax
je 0x6b7e9d
mov rcx, rax
call fcn.005e3490
test al, al
je 0x6b7e9d
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6b7e9d
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6b7e9d
test sil, sil
je 0x6b7e1c
mov rcx, qword [rbx + 0x2e0]
xor edx, edx
xor r8, r8
call fcn.006a0740
mov rcx, qword [rbx + 0xa8]
call fcn.005e2e20
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006a0740
jmp 0x6b7e86
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005e2e20
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005e2e20
mov rcx, rax
xor edx, edx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006a0740
mov rcx, qword [rbx + 0x2e0]
mov dl, 1
mov r8b, 1
call fcn.006a0740
test dil, dil
je 0x6b7e86
mov rcx, qword [rbx + 0xa8]
call fcn.005e2e20
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005d6890
test sil, sil
je 0x6b7ee3
mov rcx, qword [rbx + 0x2e0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2e0]
xor edx, edx
call sub.user32.dll_SetWindowTextW
jmp 0x6b7f35
mov rcx, qword [rbx + 0x2e0]
mov rax, rcx
mov rsi, rcx
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2e0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.00411de0
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6c2d60
Capabilities:
Hide graphical window

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
cmp qword [rbx + 0xd0], 0
jne 0x6c2e1b
mov rcx, qword [rbx + 0x10]
call fcn.005e2e20
mov rcx, qword [0x005f6448]
mov dl, 1
mov r8, rax
call fcn.005d9a50
mov qword [rbx + 0xd0], rax
mov rsi, qword [rbx + 0xd0]
mov rcx, rsi
xor edx, edx
call fcn.005fe470
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006c23e0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xd0]
call fcn.005e2e20
mov rdi, rax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005e2e20
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xf0], 0
jne 0x6c2eca
mov rcx, qword [rbx + 0x10]
call fcn.005e2e20
mov rcx, qword [0x005f6448]
mov dl, 1
mov r8, rax
call fcn.005d9a50
mov qword [rbx + 0xf0], rax
mov rsi, qword [rbx + 0xf0]
mov rcx, rsi
mov dl, 1
call fcn.005fe470
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006c2440]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xf0]
call fcn.005e2e20
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xf0]
call fcn.005e2e20
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6c2f72
mov rcx, qword [rbx + 0x10]
call fcn.005e2e20
mov rcx, qword [0x005f74f0]
mov dl, 1
mov r8, rax
call fcn.005d9a50
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov byte [rsi + 0x4a8], 1
mov rcx, qword [rbx + 0xe0]
call fcn.005e2e20
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov r13d, eax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005e2e20
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x6d04b0
Capabilities:
Authenticate hmac

Disassembly:
push rbp
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x120], rcx
mov dword [rbp + 0x128], edx
mov qword [rbp + 0x130], r8
mov dword [rbp + 0x138], r9d
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x140], rax
cmp dword [rbp + 0x138], 0x40
jle 0x6d053d
lea rcx, [rbp + 0xb8]
call fcn.006cf130
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x130]
mov r8d, dword [rbp + 0x138]
call fcn.006cf180
mov rcx, qword [rbp + 0x140]
lea rdx, [rbp + 0xb8]
call fcn.006cf2f0
mov dword [rbp + 0x138], 0x10
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x28], rax
jmp 0x6d0548
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x34], 0
mov eax, dword [rbp + 0x34]
add eax, 1
cmp eax, dword [rbp + 0x138]
jg 0x6d058a
movsxd rax, dword [rbp + 0x34]
mov rcx, qword [rbp + 0x28]
movzx rcx, byte [rcx]
xor cl, 0x36
mov byte [rax + rbp + 0x78], cl
movsxd rax, dword [rbp + 0x34]
mov rcx, qword [rbp + 0x28]
movzx rcx, byte [rcx]
xor cl, 0x5c
mov byte [rax + rbp + 0x38], cl
add qword [rbp + 0x28], 1
jmp 0x6d059c
movsxd rax, dword [rbp + 0x34]
mov byte [rax + rbp + 0x78], 0x36
movsxd rax, dword [rbp + 0x34]
mov byte [rax + rbp + 0x38], 0x5c
add dword [rbp + 0x34], 1
cmp dword [rbp + 0x34], 0x40
jne 0x6d054f
nop
lea rcx, [rbp + 0xb8]
call fcn.006cf130
lea rcx, [rbp + 0xb8]
lea rdx, [rbp + 0x78]
mov r8d, 0x40
call fcn.006cf180
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x120]
mov r8d, dword [rbp + 0x128]
call fcn.006d02c0
mov rcx, qword [rbp + 0x140]
lea rdx, [rbp + 0xb8]
call fcn.006cf2f0
lea rcx, [rbp + 0xb8]
call fcn.006cf130
lea rcx, [rbp + 0xb8]
lea rdx, [rbp + 0x38]
mov r8d, 0x40
call fcn.006cf180
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x140]
mov r8d, 0x10
call fcn.006cf180
mov rcx, qword [rbp + 0x140]
lea rdx, [rbp + 0xb8]
call fcn.006cf2f0
lea rsp, [rbp + 0x110]
pop rbp
ret
Function at 0x6e17d0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov byte [rbp + 0xb0], r8b
mov qword [rbp + 0xb8], r9
nop
mov rcx, qword [rbp + 0xa0]
call fcn.006e1d00
nop
mov rax, qword [rbp + 0xa0]
movzx rax, word [rax + 0x34]
test ax, 8
jne 0x6e1a91
mov rax, qword [rbp + 0xa0]
movzx rax, word [rax + 0x78]
test ax, 8
je 0x6e19d3
mov rax, qword [rbp + 0xa0]
movzx rax, word [rax + 0x78]
test ax, 1
je 0x6e18f7
mov rax, qword [rbp + 0xa0]
cmp qword [rax + 0x80], 0
je 0x6e18f7
mov rcx, qword [rbp + 0xa0]
lea rdx, [rbp + 0x58]
call fcn.006e1690
lea rcx, [rbp + 0x60]
mov edx, 3
mov r8, qword [rbp + 0x58]
mov rax, qword [rbp + 0xa0]
mov r9, qword [rax + 0xb0]
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.00412330
mov rax, qword [rbp + 0xa0]
lea rbx, [rax + 0x80]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0xa8]
movzx r8, byte [rbp + 0xb0]
mov r9, qword [rbp + 0x60]
call qword [rbx]
mov rax, qword [rbp + 0xa0]
movzx rax, word [rax + 0x78]
test ax, 4
je 0x6e195f
mov rcx, qword [rbp + 0xa0]
lea rdx, [rbp + 0x48]
call fcn.006e1690
lea rcx, [rbp + 0x50]
mov edx, 3
mov r8, qword [rbp + 0x48]
mov rax, qword [rbp + 0xa0]
mov r9, qword [rax + 0xb0]
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.00412330
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0x78]
call fcn.00411de0
mov rcx, rax
mov ecx, eax
mov rax, qword [rbp + 0xa0]
movzx rax, word [rax + 0x78]
movzx eax, word [rax + 0x78]
xor ecx, ecx
mov rdx, qword [rbp + 0x68]
call fcn.006e1ac0
jmp 0x6e1a9f
Function at 0x6eb8b0
Capabilities:
Hash data with md5

Disassembly:
push rbp
sub rsp, 0x20
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov rcx, qword [rbp + 0x30]
call fcn.006eb840
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x10], 0x67452301
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x14], 0xefcdab89
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x18], 0x98badcfe
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x1c], 0x10325476
mov rax, qword [rbp + 0x30]
mov byte [rax], 1
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x6ec6e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], r8
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax]
mov byte [rbp + 0x28], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax]
shl eax, 7
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 1]
shr ecx, 1
or al, cl
mov byte [rbp + 0x29], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 1]
shl eax, 6
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 2]
shr ecx, 2
or al, cl
mov byte [rbp + 0x2a], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 2]
shl eax, 5
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 3]
shr ecx, 3
or al, cl
mov byte [rbp + 0x2b], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 3]
shl eax, 4
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 4]
shr ecx, 4
or al, cl
mov byte [rbp + 0x2c], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 5]
shr ecx, 5
or al, cl
mov byte [rbp + 0x2d], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 5]
add eax, eax
add eax, eax
and al, 0xff
mov rcx, qword [rbp + 0x58]
movzx rcx, byte [rcx + 6]
shr ecx, 6
or al, cl
mov byte [rbp + 0x2e], al
mov rax, qword [rbp + 0x58]
movzx rax, byte [rax + 6]
add eax, eax
and al, 0xff
mov byte [rbp + 0x2f], al
mov dword [rbp + 0x3c], 0
mov dword [rbp + 0x38], 1
mov dword [rbp + 0x30], 0
movsxd rax, dword [rbp + 0x3c]
movzx rax, byte [rax + rbp + 0x28]
movzx rcx, byte [rbp + 0x38]
shl eax, cl
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0x34]
xor eax, dword [rbp + 0x30]
and eax, 1
mov dword [rbp + 0x30], eax
add dword [rbp + 0x38], 1
cmp dword [rbp + 0x38], 8
jne 0x6ec7e1
nop
movsxd rax, dword [rbp + 0x3c]
movsxd rcx, dword [rbp + 0x3c]
movzx rcx, byte [rcx + rbp + 0x28]
and cl, 0xfe
or cl, byte [rbp + 0x30]
mov byte [rax + rbp + 0x28], cl
add dword [rbp + 0x3c], 1
cmp dword [rbp + 0x3c], 8
jne 0x6ec7da
nop
mov rcx, qword [rbp + 0x50]
mov edx, 8
xor r8, r8
call fcn.00411920
mov rcx, qword [rbp + 0x50]
call fcn.00410ef0
mov rcx, qword [rbp + 0x60]
mov rdx, rax
lea r8, [rbp + 0x28]
mov r9b, 1
call fcn.006eb360
mov rax, qword [rbp + 0x50]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x762630
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x762706
cmp eax, 0xcb
je 0x762697
cmp eax, 0xca
jne 0x762679
mov rcx, rsi
call fcn.00762df0
cmp dword [rsi + 0x58], 0
je 0x762690
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x762713
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x762706
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x7626fa
mov rdx, qword [rsi + 0x10]
jmp 0x7626b9
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x7626c3
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x762711
cmp eax, 2
je 0x7626fa
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x7626b9
test rdx, rdx
je 0x7626b9
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x7626b9
jmp 0x7626b0
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x762720
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x762758
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x7627fd
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x7627ce
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x76279a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x762811
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x762780
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x762776
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x762720
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x762706
cmp eax, 0xcb
je 0x762697
cmp eax, 0xca
jne 0x762679
mov rcx, rsi
call fcn.00762df0
cmp dword [rsi + 0x58], 0
je 0x762690
mov dword [rsi + 0x24], 0xcf
mov eax, 1
jmp 0x762713
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
jmp 0x762706
mov dword [rsi + 0x24], 0xcb
mov rax, qword [rsi + 0x240]
cmp dword [rax + 0x20], 0
je 0x7626fa
mov rdx, qword [rsi + 0x10]
jmp 0x7626b9
add eax, dword [rsi + 0x1a4]
mov dword [rdx + 0xc], eax
test rdx, rdx
je 0x7626c3
mov rcx, rsi
call qword [rdx]
mov rax, qword [rsi + 0x240]
mov rcx, rsi
call qword [rax]
test eax, eax
je 0x762711
cmp eax, 2
je 0x7626fa
mov rdx, qword [rsi + 0x10]
or eax, 2
cmp eax, 3
jne 0x7626b9
test rdx, rdx
je 0x7626b9
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
inc ecx
mov dword [rdx + 8], ecx
cmp ecx, eax
jl 0x7626b9
jmp 0x7626b0
mov eax, dword [rsi + 0xac]
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp 0x762720
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
cmp dword [rsi + 0x24], 0xcc
je 0x762758
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov dword [rsi + 0x24], 0xcc
mov rdx, qword [rsi + 0x220]
cmp dword [rdx + 0x10], 0
je 0x7627fd
lea r14, [rsi + 0xa8]
mov eax, dword [rsi + 0xa8]
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jae 0x7627ce
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x76279a
mov dword [rdx + 8], eax
mov dword [rdx + 0xc], ecx
mov rcx, rsi
call qword [rdx]
mov eax, dword [rsi + 0xa8]
mov edi, eax
mov rax, qword [rsi + 0x228]
xor ebx, ebx
xor edx, edx
xor r9d, r9d
mov rcx, rsi
mov r8, r14
call qword [rax + 8]
mov eax, dword [rsi + 0xa8]
cmp eax, edi
je 0x762811
mov ecx, dword [rsi + 0x8c]
cmp eax, ecx
jb 0x762780
mov rdx, qword [rsi + 0x220]
mov rcx, rsi
call qword [rdx + 8]
mov rax, qword [rsi + 0x220]
mov rcx, rsi
call qword [rax]
mov dword [rsi + 0xa8], 0
mov rdx, qword [rsi + 0x220]
xor eax, eax
cmp dword [rdx + 0x10], 0
jne 0x762776
cmp dword [rsi + 0x5c], 1
mov eax, 0xce
sbb eax, 0
mov dword [rsi + 0x24], eax
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x762990
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov edi, edx
mov rsi, rcx
mov eax, dword [rsi + 0x24]
cmp eax, 0xcc
je 0x7629c7
cmp eax, 0xcf
je 0x7629c7
mov rcx, qword [rsi]
mov dword [rcx + 0x28], 0x14
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
test edi, edi
mov eax, 1
cmovg eax, edi
mov rcx, qword [rsi + 0x240]
cmp dword [rcx + 0x24], 0
je 0x7629e9
mov ecx, dword [rsi + 0xac]
cmp eax, ecx
cmovg eax, ecx
mov dword [rsi + 0xb4], eax
mov rcx, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp 0x762720