joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017f30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18004e010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18004edc8]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x180017f91
cmp byte [rbx + 0x4d4e], 0
jne 0x180017f91
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180007db0
test dil, 2
je 0x1800180bf
jmp 0x18001801a
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5eb8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1800452cc]
mulss xmm1, dword [0x1800452c0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x180045250]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
call fcn.180007db0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180018070
lea r11, [0x18003f250]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180018053
cmp byte [r8], r9b
jne 0x180018053
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180018040
not ecx
call fcn.18000e480
test rax, rax
je 0x1800180bf
cmp byte [rax + 0xbe], 0
je 0x1800180bf
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.180007db0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.1800111b0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003b630
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18001cbf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x18001cc73
xor edx, edx
add rcx, 0x6018
call fcn.18001f3a0
mov r8, rsi
lea rcx, [rbx + 0x6018]
mov rdx, rbp
call fcn.180008830
mov eax, dword [rbx + 0x6018]
xor edx, edx
mov r9, qword [rbx + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6020]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x18004ed92]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001cc7f
add rcx, 0x6018
call fcn.180008830
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001d0d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18004edc8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001d133
mov qword [rsp], rbx
lea rbx, [0x18003f250]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001d113
cmp byte [r8], r9b
jne 0x18001d113
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001d100
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001d15f
cmp dword [r8 + 8], eax
je 0x18001d166
add r8, 0x48
cmp r8, rcx
jne 0x18001d150
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x18001d3b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x18004edc8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5f6c], ecx
test rbx, rbx
je 0x18001d41f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.18001d430
lea rdx, [0x180044874]
mov rcx, rbx
mov rdi, rax
call fcn.180007f70
mov rbx, rax
test rax, rax
je 0x18001d41a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18002fd40
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x18004e010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x18004edc8]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18002ff5e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18002ff5e
mov rdx, qword [0x18004edc0]
mov ecx, 0x50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, qword [0x18004edc8]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18002fe1a
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18002fe0f
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x18002fe37
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18002fe3a
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x180044fc8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18002fe7d
mov rsi, qword [r8 + 0x90]
jmp 0x18002fe80
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18002feab
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x18004edc8]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18002ff1e
inc rbx
cmp rbx, 5
jl 0x18002ff00
jmp 0x18002ff4a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18002ff60
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18003b630
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x1800300f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18004edc8]
mov edx, 0x210
call fcn.1800142f0
cmp byte [rax], 0
je 0x180030166
xor edx, edx
mov ecx, 0x210
call fcn.180016a00
test al, al
je 0x180030166
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180030166
mov rbx, qword [0x18004edc8]
cmp byte [rbx + 0x38d1], 0
je 0x180030152
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180007720
mov dword [rbx + 0x370], 0x210
mov dword [rbx + 0x930], 0xa0
mov rcx, qword [0x18004edc8]
mov edx, 0x214
call fcn.1800142f0
cmp byte [rax], 0
je 0x1800301d6
xor edx, edx
mov ecx, 0x214
call fcn.180016a00
test al, al
je 0x1800301d6
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800301d6
mov rbx, qword [0x18004edc8]
cmp byte [rbx + 0x38d1], 0
je 0x1800301c2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180007720
mov dword [rbx + 0x374], 0x214
mov dword [rbx + 0x940], 0xa1
mov rcx, qword [0x18004edc8]
mov edx, 0x212
call fcn.1800142f0
cmp byte [rax], 0
je 0x180030246
xor edx, edx
mov ecx, 0x212
call fcn.180016a00
test al, al
je 0x180030246
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180030246
mov rbx, qword [0x18004edc8]
cmp byte [rbx + 0x38d1], 0
je 0x180030232
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180007720
mov dword [rbx + 0x25c], 0x212
mov dword [rbx + 0x938], 0x5b
mov rcx, qword [0x18004edc8]
mov edx, 0x216
call fcn.1800142f0
cmp byte [rax], 0
je 0x1800302b6
xor edx, edx
mov ecx, 0x216
call fcn.180016a00
test al, al
je 0x1800302b6
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800302b6
mov rbx, qword [0x18004edc8]
cmp byte [rbx + 0x38d1], 0
je 0x1800302a2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180007720
mov dword [rbx + 0x260], 0x216
mov dword [rbx + 0x948], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x18003b0f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18004e010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov dword [rsp + 0x20], 0
movzx esi, dl
add rbx, qword [0x18004ede0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003b16c
mov eax, 0xa
jmp 0x18003b1fb
test sil, sil
je 0x18003b18f
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18003b1b2
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18003b1b2
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18003b1ab
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18003b1b2
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, byte [rbx + 0x20]
movzx eax, sil
and cl, 0xfd
shl sil, 2
add al, al
or cl, al
and cl, 0xfb
or cl, sil
mov byte [rbx + 0x20], cl
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18003b630
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18003b220
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [0x18004edec]
xor ebx, ebx
test edx, edx
je 0x18003b24f
mov rcx, qword [0x18004ede0]
add rcx, 0x20
nop dword [rax]
test byte [rcx], 2
jne 0x18003b257
inc ebx
add rcx, 0x38
cmp ebx, edx
jb 0x18003b240
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp ebx, 0xffffffff
je 0x18003b24f
xor r8d, r8d
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x20]
call fcn.18003ad80
mov edi, eax
test eax, eax
jne 0x18003b334
mov r8d, dword [0x18004edec]
cmp ebx, r8d
jae 0x18003b2c1
nop dword [rax]
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18004ede0]
test byte [rdx + rcx + 0x20], 2
je 0x18003b2ba
xor edx, edx
mov ecx, ebx
call fcn.18003b0f0
mov edi, eax
test eax, eax
jne 0x18003b2c1
mov r8d, dword [0x18004edec]
inc ebx
cmp ebx, r8d
jb 0x18003b290
cmp qword [rsp + 0x20], 0
je 0x18003b332
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18003b31e
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18003b30a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18003b2e2
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004edf0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x18003b400
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov edi, 1
mov esi, r15d
mov ebx, r15d
xor eax, eax
lock cmpxchg dword [0x18004edb4], edi
je 0x18003b44f
nop
cmp ebx, 0x20
jae 0x18003b439
xor ecx, ecx
jmp 0x18003b43b
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
xor eax, eax
lock cmpxchg dword [0x18004edb4], edi
jne 0x18003b430
cmp qword [0x18004edf0], rsi
je 0x18003b57d
mov r8d, dword [0x18004edec]
mov ebx, r15d
test r8d, r8d
je 0x18003b582
mov rdx, qword [0x18004ede0]
add rdx, 0x20
nop word [rax + rax]
movzx ecx, byte [rdx]
shr cl, 1
xor cl, byte [rdx]
test cl, 2
jne 0x18003b49c
inc ebx
add rdx, 0x38
cmp ebx, r8d
jb 0x18003b480
jmp 0x18003b582
cmp ebx, 0xffffffff
je 0x18003b582
mov r8d, 2
lea rcx, [rsp + 0x20]
call fcn.18003ad80
mov esi, eax
test eax, eax
jne 0x18003b582
mov r9d, dword [0x18004edec]
cmp ebx, r9d
jae 0x18003b513
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18004ede0]
movzx r8d, byte [rdx + rcx + 0x20]
movzx edx, r8b
shr r8b, 1
shr dl, 2
and r8b, dil
and dl, dil
cmp r8b, dl
je 0x18003b50c
mov ecx, ebx
call fcn.18003b0f0
mov esi, eax
test eax, eax
jne 0x18003b513
mov r9d, dword [0x18004edec]
inc ebx
cmp ebx, r9d
jb 0x18003b4d0
cmp qword [rsp + 0x20], r15
je 0x18003b582
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18003b567
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18003b558
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18003b530
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18004edf0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003b582
mov esi, 2
xchg dword [0x18004edb4], r15d
mov rbx, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x140002630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r8, qword [rcx]
mov r14, rcx
movabs rcx, 0xffffffff00000000
movzx eax, word [r8 + 0x14]
mov r12, qword [r8 + 0x30]
mov r9d, dword [r14 + 0x68]
and r12, rcx
dec r9
mov r11d, dword [rax + r8 + 0x20]
not r9
mov ecx, dword [rax + r8 + 0x28]
or r11, r12
and r9, r11
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r9
test ecx, ecx
jne 0x140002698
mov edx, dword [rax + r8 + 0x3c]
test dl, 0x40
je 0x140002690
mov ecx, dword [r8 + 0x20]
jmp 0x140002698
test dl, dl
jns 0x140002698
mov ecx, dword [r8 + 0x24]
mov edx, dword [rax + r8 + 0x3c]
mov r13d, 1
mov r15d, r13d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov r10d, ecx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 0
cmp r13w, word [r8 + 6]
jae 0x140002799
lea rdi, [r8 + 0x64]
add rdi, rax
nop word [rax + rax]
mov esi, dword [rdi - 0x1c]
mov ebx, dword [r14 + 0x68]
or rsi, r12
mov eax, dword [rdi - 0x14]
neg rbx
and rbx, rsi
test eax, eax
jne 0x14000271c
mov ecx, dword [rdi]
test cl, 0x40
je 0x140002714
mov eax, dword [r8 + 0x20]
jmp 0x14000271c
test cl, cl
jns 0x14000271c
mov eax, dword [r8 + 0x24]
mov ebp, eax
cmp r9, rbx
je 0x140002760
lea rax, [r10 + r11]
cmp rax, rbx
ja 0x140002760
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140002570
test eax, eax
je 0x14000283c
mov edx, dword [rdi]
mov r11, rsi
mov r8, qword [r14]
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r10d, ebp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbp
jmp 0x140002780
mov ecx, dword [rdi]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x140002772
btr edx, 0x19
mov r10, rbp
sub r10, r11
add r10, rsi
mov qword [rsp + 0x30], r10
movzx eax, word [r8 + 6]
inc r15d
add rdi, 0x28
mov dword [rsp + 0x38], edx
cmp r15d, eax
jl 0x1400026f0
test r10, r10
je 0x1400027bd
bt edx, 0x19
jae 0x1400027e7
cmp r11, r9
jne 0x1400027bd
mov r9, qword [r14 + 0x58]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [r14 + 0x30]
mov eax, r13d
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
mov rax, rcx
shr rcx, 0x1e
shr rax, 0x1d
and ecx, r13d
and eax, r13d
lea rcx, [rcx + rax*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, section..data
mov eax, dword [rax + rcx*4]
mov r8d, eax
bts r8d, 9
mov rcx, r11
and edx, 0x4000000
mov rdx, r10
cmove r8d, eax
call qword [0x140019f00]
test eax, eax
jne 0x1400027bd
xor eax, eax
jmp 0x1400027c0
Function at 0x1400039b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xb0
lea rax, [rsp + 0xc0]
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x140003950]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140003990]
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xc8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xc8], 0
jne 0x140003b4c
xor r9d, r9d
lea r8, str.test2
lea rdx, str.test
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [0x14001520a]
call fcn.140003000
mov r8d, eax
lea r9, str.Test
lea rdx, [0x14001520a]
lea rcx, [rsp + 0x40]
call fcn.140003b60
lea rcx, [rsp + 0x40]
call fcn.140003cd0
test al, al
je 0x140003b4c
call fcn.1400014f0
test eax, eax
je 0x140003b4c
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xd8]
lea rdx, [0x14001520a]
lea rcx, [rsp + 0x40]
call fcn.140003ce0
test eax, eax
jne 0x140003b4c
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
call fcn.140001630
test rax, rax
je 0x140003b4c
lea rdx, [0x14001520a]
mov rcx, rax
call fcn.140001d70
test rax, rax
je 0x140003b3e
call rax
mov rcx, rax
mov rbx, rax
call fcn.140002dd0
mov r9, rax
lea rdx, [0x14001520a]
lea rax, [rsp + 0x30]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140003df0
test eax, eax
jne 0x140003b3e
add rsp, 0xb0
pop rbx
ret
mov eax, 2
add rsp, 0xb0
pop rbx
ret
mov eax, 1
add rsp, 0xb0
pop rbx
ret
Function at 0x1413f2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413f21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1413f2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f206f
add dl, dl
jne 0x1413f2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f20f6
xor eax, eax
add dl, dl
jne 0x1413f20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f21ad
add dl, dl
jne 0x1413f20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413f20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1413f207e
mov eax, 1
add dl, dl
jne 0x1413f2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f20fb
sub eax, ebx
mov ebx, 1
jne 0x1413f214c
mov ecx, 1
add dl, dl
jne 0x1413f212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413f213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1413f2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413f2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f215d
cmp eax, 0x7d00
jae 0x1413f219b
cmp eax, 0x500
jb 0x1413f2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f207e
cmp eax, 0x7f
ja 0x1413f219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413f21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1413f207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2fc4d9880
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da282
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4da31a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4da2fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da2f2
cmp qword [rbp - 0x10], 0
je 0x2fc4da2f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da2b8
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da31b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da420
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da448
mov eax, 0
jmp 0x2fc4da496
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da471
mov eax, 0
jmp 0x2fc4da496
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da491
mov eax, 0
jmp 0x2fc4da496
mov eax, 1
add rsp, 0x20
pop rbp
ret