joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006ecb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x180111040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r9, qword [0x1802107b8]
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov rdi, r9
mov rbx, qword [r9 + 0x4000]
test edx, edx
jne 0x18006ed18
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.id___0
call fcn.1800ca978
mov r9, qword [0x1802107b8]
or dword [rdi + 0x4a00], 0x100
mov dword [rdi + 0x4a38], 1
mov rdx, qword [r9 + 0x4000]
cmp qword [rdx + 0x1b8], 0
jne 0x18006ed4c
cmp qword [r9 + 0x4e18], 0
mov eax, 0x260
je 0x18006ed51
mov eax, 0x230
movss xmm2, dword [rdx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rdx + rax + 4]
subss xmm3, dword [rdx + 0x114]
subss xmm2, dword [rdx + 0x110]
mov rdx, qword [r14]
call fcn.18007a200
or dword [r9 + 0x4a00], 2
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x30]
xor edx, edx
movsd qword [r9 + 0x4a20], xmm0
mov dword [r9 + 0x4a08], 1
mov r9, qword [rbx + 8]
test rsi, rsi
je 0x18006edc2
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rsi
call fcn.180067810
jmp 0x18006edd2
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.180067810
mov rcx, qword [rsp + 0x30]
xor edx, edx
movss xmm6, dword [rdi + 0x3918]
mov r8d, 0x1000107
call fcn.180072430
mov rsi, qword [rdi + 0x4000]
movzx r14d, al
movss dword [rdi + 0x3918], xmm6
cmp word [rsi + 0xcc], 1
mov dword [rsi + 0x88], ebp
jne 0x18006ee1c
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, ebp
lea rdx, [0x1800f0e61]
not r9d
lea r10, [0x1800f5870]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x18006ee49
cmp byte [rdx], r8b
jne 0x18006ee49
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18006ee36
not ebx
cmp dword [rdi + 0x4064], ebx
jne 0x18006ee79
xor edx, edx
xor ecx, ecx
call fcn.18006ae40
cmp dword [rdi + 0x4b38], ebp
jne 0x18006eebe
cmp word [rsi + 0x16c], 0
jne 0x18006ee94
cmp byte [rsi + 0x172], 0
je 0x18006eebe
xor edx, edx
mov rcx, rsi
call fcn.180075280
xor edx, edx
mov rcx, rsi
call fcn.18007d9d0
mov rdx, rsi
mov ecx, ebx
call fcn.18006ae40
mov eax, dword [rdi + 0x4b64]
mov dword [rdi + 0x4090], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b5010
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x18007b380
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180111040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1802107b8]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x18007b3e1
cmp byte [rbx + 0x4d4e], 0
jne 0x18007b3e1
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180067790
test dil, 2
je 0x18007b50f
jmp 0x18007b46a
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800fda08]
xor eax, eax
mulss xmm1, dword [0x1800fd9f0]
addss xmm0, dword [rbx + 0xe40]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x1800fd924]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
movsx r9d, word [rbx + 0x5eb8]
call fcn.180067790
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18007b4c0
lea r11, [0x1800f5870]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x18007b4a3
cmp byte [r8], r9b
jne 0x18007b4a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18007b490
not ecx
call fcn.18006f210
test rax, rax
je 0x18007b50f
cmp byte [rax + 0xbe], 0
je 0x18007b50f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.180067790
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.180072430
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800b5010
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180081ea0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1802107b8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180081f03
mov qword [rsp], rbx
lea rbx, [0x1800f5870]
nop dword [rax]
cmp r9b, 0x23
jne 0x180081ee3
cmp byte [r8], r9b
jne 0x180081ee3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180081ed0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x180081f2f
cmp dword [r8 + 8], eax
je 0x180081f36
add r8, 0x48
cmp r8, rcx
jne 0x180081f20
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1800987e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180111040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [0x1802107b8]
mov rdi, rcx
test rbx, rbx
jne 0x180098825
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800ca978
mov rbx, qword [0x1802107b8]
cmp qword [rbx + 0x90], 0
je 0x180098845
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.io.BackendPlatformUserData__nullptr___Already_initialized_a_platform_backend__
call fcn.1800ca978
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1800989b4
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1800989b4
mov ecx, 0x30
mov qword [rsp + 0x60], rsi
call fcn.1800caa84
mov r9, qword [0x1802107b8]
xor esi, esi
mov r8, rax
test r9, r9
je 0x1800988ea
movsx rdx, word [r9 + 0x60f0]
lea rax, [r9 + 0x60f4]
mov r10d, dword [r9 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r10d
je 0x1800988df
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r9 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r9
mov dword [rax], r10d
mov dword [rax + 4], esi
inc word [rax + 4]
inc dword [r9 + 0x60e8]
test r8, r8
je 0x180098902
xorps xmm0, xmm0
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
jmp 0x180098905
mov r8, rsi
or dword [rbx + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x90], r8
mov qword [r8], rdi
mov rax, qword [rsp + 0x30]
mov qword [r8 + 0x20], rax
mov rax, qword [rsp + 0x38]
mov qword [r8 + 0x18], rax
mov dword [r8 + 0x28], 9
test r9, r9
je 0x180098949
mov rbx, qword [r9 + 0x90]
jmp 0x18009894c
mov rbx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180098977
mov dword [rbx + 0x2c], esi
mov rbx, qword [0x1802107b8]
mov rsi, qword [rsp + 0x60]
cmp dword [rbx + 0x4b08], 0
jg 0x1800989a2
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.i___0__i___Size
call fcn.1800ca978
mov rax, qword [rbx + 0x4b10]
mov rcx, qword [rax]
mov al, 1
mov qword [rcx + 0x28], rdi
jmp 0x1800989b6
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800b5010
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180098c40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1802107b8]
mov edx, 0x210
call fcn.180076280
cmp byte [rax], 0
je 0x180098ce1
mov rcx, qword [0x1802107b8]
mov edx, 0x210
call fcn.180066730
cmp byte [rax + 8], 0
jne 0x180098ce1
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180098ce1
cmp qword [0x1802107b8], 0
jne 0x180098ca9
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800ca978
mov rbx, qword [0x1802107b8]
cmp byte [rbx + 0x38d1], 0
je 0x180098ccd
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180066d10
mov dword [rbx + 0x370], 0x210
mov dword [rbx + 0x930], 0xa0
mov rcx, qword [0x1802107b8]
mov edx, 0x214
call fcn.180076280
cmp byte [rax], 0
je 0x180098d7c
mov rcx, qword [0x1802107b8]
mov edx, 0x214
call fcn.180066730
cmp byte [rax + 8], 0
jne 0x180098d7c
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180098d7c
cmp qword [0x1802107b8], 0
jne 0x180098d44
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800ca978
mov rbx, qword [0x1802107b8]
cmp byte [rbx + 0x38d1], 0
je 0x180098d68
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180066d10
mov dword [rbx + 0x374], 0x214
mov dword [rbx + 0x940], 0xa1
mov rcx, qword [0x1802107b8]
mov edx, 0x212
call fcn.180076280
cmp byte [rax], 0
je 0x180098e17
mov rcx, qword [0x1802107b8]
mov edx, 0x212
call fcn.180066730
cmp byte [rax + 8], 0
jne 0x180098e17
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180098e17
cmp qword [0x1802107b8], 0
jne 0x180098ddf
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800ca978
mov rbx, qword [0x1802107b8]
cmp byte [rbx + 0x38d1], 0
je 0x180098e03
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180066d10
mov dword [rbx + 0x25c], 0x212
mov dword [rbx + 0x938], 0x5b
mov rcx, qword [0x1802107b8]
mov edx, 0x216
call fcn.180076280
cmp byte [rax], 0
je 0x180098eb4
mov rcx, qword [0x1802107b8]
mov edx, 0x216
call fcn.180066730
cmp byte [rax + 8], 0
jne 0x180098eb4
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180098eb4
mov rbx, qword [0x1802107b8]
test rbx, rbx
jne 0x180098e83
xor r8d, r8d
lea rdx, [0x1800efa88]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.1800ca978
mov rbx, qword [0x1802107b8]
cmp byte [rbx + 0x38d1], 0
je 0x180098ea0
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180066d10
mov dword [rbx + 0x260], 0x216
mov dword [rbx + 0x948], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x1800bc544
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800bc3f7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800bc3f7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800bc3f7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800bc3f7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800bc3f7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800bc3f7
cmp dword [rcx + 0xf8], 0
je 0x1800bc3f7
mov ecx, ebx
call fcn.1800bc4a8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800bc284
nop
cmp dword [rbp + 0x20], 0
je 0x1800bc445
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800bc450
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800bc388
Function at 0x1800cfeec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1800cff02
mov al, 1
jmp 0x1800cff62
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800cff13
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800cff60
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800d5158
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800cff60
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800cff60
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800cff60
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800cff62
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800d28f4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800d2924
xor eax, eax
jmp 0x1800d29e7
mov rbp, rbx
cmp word [rax], si
je 0x1800d2949
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800d2930
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800d292c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800d2814
movsxd r14, eax
test eax, eax
jne 0x1800d2987
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800d291d
mov rcx, r14
call fcn.1800cc718
mov rdi, rax
test rax, rax
jne 0x1800d29a0
xor ecx, ecx
call fcn.1800cc6dc
jmp 0x1800d297c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800d2814
test eax, eax
jne 0x1800d29d1
mov rcx, rdi
call fcn.1800cc6dc
jmp 0x1800d29db
xor ecx, ecx
call fcn.1800cc6dc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800d7350
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800d7378
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800d7378
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push rdi
push 0x30
push rbp
hlt
Function at 0x5bdbd20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x5bdbd2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x5bdbd3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x5bdbd25
lea eax, [rcx + 1]
jmp 0x5bdbd4b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x5bdbd5e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x5bdbd44
sub eax, 3
jb 0x5bdbd7e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x5bdbdcd
sar eax, 1
movsxd rbp, eax
jb 0x5bdbdb4
jmp 0x5bdbd8c
add ebx, ebx
jne 0x5bdbd8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5bdbdb4
inc ecx
add ebx, ebx
jne 0x5bdbd9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5bdbdb4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x5bdbdad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x5bdbd9c
add ecx, 2
jmp 0x5bdbdb9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.05bdbce2
jmp 0x5bdbd2d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5782000]
mov eax, dword [rdi]
or eax, eax
je 0x5bdbe29
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x57db000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x5bdbdd9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x5bdbe23
mov qword [rbx], rax
add rbx, 8
jmp 0x5bdbdf9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x5bdbe6d
cmp al, 0xef
ja 0x5bdbe55
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x5bdbe35
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x5bdbe44
mov eax, dword [rdi]
add rdi, 4
jmp 0x5bdbe44
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x5bdbec1
sub rsp, 0xffffffffffffff80
jmp 0x4727e0
Function at 0x1405ed058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405ed1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405ed089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed06f
add dl, dl
jne 0x1405ed096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed0f6
xor eax, eax
add dl, dl
jne 0x1405ed0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ed1ad
add dl, dl
jne 0x1405ed0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405ed0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405ed07e
mov eax, 1
add dl, dl
jne 0x1405ed106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ed113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed0fb
sub eax, ebx
mov ebx, 1
jne 0x1405ed14c
mov ecx, 1
add dl, dl
jne 0x1405ed12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ed13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405ed168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ed175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ed15d
cmp eax, 0x7d00
jae 0x1405ed19b
cmp eax, 0x500
jb 0x1405ed196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
cmp eax, 0x7f
ja 0x1405ed19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ed07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405ed1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405ed07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400016c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov edx, 0x64
mov dword [rbp - 0x40], 0x3c8bb26
xor ecx, ecx
mov dword [rbp - 0x3c], 0xda59c13a
mov dword [rbp - 0x38], 0x25f98011
mov dword [rbp - 0x34], 0x786f8c3e
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r9d, 0x10
lea r8, [rbp - 0x40]
mov edx, eax
mov rcx, rdi
mov esi, eax
call fcn.140001000
lea rcx, str.notepad.exe
call fcn.140001130
mov ebx, eax
mov dword [rbp - 0x30], 0x12deaef0
lea rax, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x987829f4
mov dword [rbp - 0x28], 0xfc40ed6
mov rdx, 0xffffffffffffffff
mov dword [rbp - 0x24], 0x923c58c6
mov dword [rbp - 0x20], 0xd61c707e
mov dword [rbp - 0x1c], 0xfbd79498
mov dword [rbp - 0x18], 0x6e9b4101
mov dword [rbp - 0x14], 0xe8ec921c
mov byte [rbp - 0x10], 0
inc rdx
cmp byte [rax + rdx], 0
jne 0x140001794
mov r9d, 0x10
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140001000
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x15], 0
lea rcx, str.sOpenProcess___s_n
call fcn.140001850
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ed68], rax
test ebx, ebx
je 0x140001826
mov edx, ebx
lea rcx, str.Notepad.exe_PID___d_n
call fcn.140001850
mov r8d, ebx
xor edx, edx
mov ecx, 0x43a
call qword [0x14001ed68]
mov rbx, rax
test rax, rax
je 0x140001826
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call fcn.1400013f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret

Function at 0x140005934
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005760
Function at 0x1400047c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000bad0
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000bb0d
test rdx, rdx
je 0x14000bb0d
mov rax, qword [rax]
cmp rax, r9
jne 0x14000baf0
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret

Function at 0x140006b00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, ecx
movsxd rbx, edx
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdi, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceFrequency
mov r14d, 0x1e
mov rdx, rbx
imul rdx, qword [rsp + 0x50]
movabs rax, 0x431bde82d7b634db
imul rdx
mov rbp, rdx
sar rbp, 0x12
mov rax, rbp
shr rax, 0x3f
add rbp, rax
add rbp, rdi
cmp esi, r14d
cmovb r14d, esi
xor edi, edi
test r14d, r14d
jle 0x140006ba2
mov ebx, 1
test ebx, ebx
jle 0x140006b88
mov eax, ebx
nop dword [rax]
pause
sub rax, 1
jne 0x140006b80
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceCounter
cmp qword [rsp + 0x50], rbp
jg 0x140006ba2
inc edi
rol ebx, 1
cmp edi, r14d
jl 0x140006b73
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret