joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078c10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140078c53
jmp 0x140078d45
movsxd rax, dword [rsp + 0x30]
shl rax, 1
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140078c8c
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
call fcn.140085bd0
jmp 0x140078d45
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140078cc5
lea rdx, [0x1400c2758]
mov ecx, 0x10008
call fcn.140085bd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140078d45
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x140137dd8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140078d29
lea rdx, [0x1400c2780]
mov ecx, 0x10008
call fcn.140085bd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140078d45
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rsp + 0x38]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x50
pop rdi
ret

Function at 0x140078d60
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x30
mov rcx, qword [0x140137dd8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140078d8f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140085bd0
xor eax, eax
jmp 0x140078e2b
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140078dc2
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140085bd0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x140078e2b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140078df5
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.140085bd0
call qword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x140078e2b
mov rcx, qword [0x140137df0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x28]
call fcn.140085820
mov qword [0x140137df0], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x140137df0]
add rsp, 0x30
pop rdi
ret
Function at 0x14007a870
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x30]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400e5f40]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14007a918
cmp dword [rsp + 0x40], 0x12
jne 0x14007a900
mov rax, qword [0x140136b10]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x14007a8fe
mov rcx, qword [rsp + 0x80]
call fcn.140077070
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
jmp 0x14007a8d1
jmp 0x14007a916
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14007a89c
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x14007aaa6
lea rdx, str.GLFW
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetPropW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x14007aaa6
mov dword [rsp + 0x98], 0xa0
mov dword [rsp + 0x9c], 0x154
mov dword [rsp + 0xa0], 0xa1
mov dword [rsp + 0xa4], 0x158
mov dword [rsp + 0xa8], 0x5b
mov dword [rsp + 0xac], 0x157
mov dword [rsp + 0xb0], 0x5c
mov dword [rsp + 0xb4], 0x15b
mov dword [rsp + 0x88], 0
jmp 0x14007a9cd
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 4
jge 0x14007aaa6
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 1
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rsp + 0xc8]
lea rcx, [0x1401381f8]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0xcc], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007aa57
jmp 0x14007a9bd
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
movsx eax, byte [rcx + rax + 0x90]
cmp eax, 1
je 0x14007aa79
jmp 0x14007a9bd
call fcn.14007bf50
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
call fcn.140072e70
jmp 0x14007a9bd
mov rax, qword [0x140138b98]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x14007ab49
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd4]
mov rcx, qword [rsp + 0x80]
call fcn.1400794b0
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x394], eax
jne 0x14007ab19
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x398], eax
je 0x14007ab49
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm0, eax
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm1, eax
movaps xmm2, xmm0
mov rcx, qword [rsp + 0x80]
call fcn.1400787d0
mov rcx, rsp
lea rdx, [0x1400a6bc0]
call fcn.14008b090
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.14008a650
add rsp, 0x120
pop rdi
ret
Function at 0x14007b900
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x358]
mov qword [rsp + 0x30], rax
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x14007b978
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.140085bd0
mov rcx, rsp
lea rdx, [0x1400a6eb0]
call fcn.14008b090
add rsp, 0x50
pop rdi
ret

Function at 0x14007b9a0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x14007ba10
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.140085bd0
mov rcx, rsp
lea rdx, [0x1400a6f00]
call fcn.14008b090
add rsp, 0x50
pop rdi
ret

Function at 0x14007bf50
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007bf7e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007bf9e
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007bfbe
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x14007bff6
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x14007c014
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x14007c032
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140081d30
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x140081d60
mov r8d, 0x29
lea rdx, [0x1400e0260]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x140081d8e
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.140085bd0
xor eax, eax
jmp 0x140081d9e
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140081df0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x140081e20
mov r8d, 0x40
lea rdx, [0x1400e0330]
lea rcx, [0x1400e0390]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x140081e40
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x140081e75
mov r8d, 0x46
lea rdx, [0x1400e03e0]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x140085d20
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400e5f40]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x1401384b2]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x20
jmp 0x140085d85
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x140085f89
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x1401381f8]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x140085db6
jmp 0x140085d7b
cmp dword [rsp + 0x40], 0x140
jl 0x140085e92
cmp dword [rsp + 0x40], 0x14e
jg 0x140085e92
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], 0x69
mov dword [rsp + 0x1e0], 0x6e
mov dword [rsp + 0x1e4], 0x6f
mov dword [rsp + 0x1e8], 0x6a
mov dword [rsp + 0x1ec], 0x6d
mov dword [rsp + 0x1f0], 0x6b
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x140085eab
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x140085f25
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x140085f34
jmp 0x140085d7b
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x1401384b2]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x140085d7b
mov rcx, rsp
lea rdx, [0x1400a8ba0]
call fcn.14008b090
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14008a650
add rsp, 0x220
pop rdi
ret
Function at 0x140089010
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400e5f40]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x140138e08], 0
je 0x14008906b
mov eax, 1
jmp 0x1400891eb
mov dword [rsp + 0x20], 0
jmp 0x14008907f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x1400890b1
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140138e08], rax
cmp qword [0x140138e08], 0
je 0x1400890af
jmp 0x1400890b1
jmp 0x140089075
cmp qword [0x140138e08], 0
jne 0x1400890d3
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.14007e710
xor eax, eax
jmp 0x1400891eb
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e10], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e18], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e20], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e28], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e30], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e38], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x140138e08]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138e40], rax
cmp qword [0x140138e10], 0
je 0x1400891cc
cmp qword [0x140138e20], 0
je 0x1400891cc
cmp qword [0x140138e28], 0
je 0x1400891cc
cmp qword [0x140138e30], 0
je 0x1400891cc
cmp qword [0x140138e38], 0
je 0x1400891cc
cmp qword [0x140138e40], 0
jne 0x1400891e6
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.14007e710
call fcn.140089220
xor eax, eax
jmp 0x1400891eb
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400a8ff0]
call fcn.14008b090
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008a650
add rsp, 0x70
pop rdi
ret

Function at 0x14008b4a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008b4ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008b4ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008b4ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008b4ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14008b4ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008b4f0
xor al, al
add rsp, 0x28
ret
Function at 0x140cab0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140cab237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140cab0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cab0c7
add dl, dl
jne 0x140cab0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cab14e
xor eax, eax
add dl, dl
jne 0x140cab0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cab205
add dl, dl
jne 0x140cab10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cab11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cab128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cab135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140cab142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140cab0d6
mov eax, 1
add dl, dl
jne 0x140cab15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cab16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cab153
sub eax, ebx
mov ebx, 1
jne 0x140cab1a4
mov ecx, 1
add dl, dl
jne 0x140cab186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cab193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cab17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cab0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140cab1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cab1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cab1b5
cmp eax, 0x7d00
jae 0x140cab1f3
cmp eax, 0x500
jb 0x140cab1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cab0d6
cmp eax, 0x7f
ja 0x140cab1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cab0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140cab22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140cab0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140058000
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005800d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005801d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140058005
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140058035
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140058022
sub eax, 3
jb 0x14005804f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140058086
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140058076
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140058074
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140058063
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140057fc2
jmp 0x14005800d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a000
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400580d2
cmp rsi, rcx
jae 0x1400580da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400580b9
cmp al, 0x8f
ja 0x1400580b9
cmp byte [rsi - 2], 0xf
je 0x1400580bf
sub al, 0xe8
cmp al, 1
ja 0x1400580a3
cmp rsi, rcx
jae 0x1400580da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400580a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400580da
lodsb al, byte [rsi]
jmp 0x1400580b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x55000]
mov eax, dword [rdi]
or eax, eax
je 0x140058137
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x66fb0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400580e7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140058131
mov qword [rbx], rax
add rbx, 8
jmp 0x140058107
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140058171
cmp al, 0xef
ja 0x140058163
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140058143
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140058152
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400581c5
sub rsp, 0xffffffffffffff80
jmp 0x14000b6d0
Function at 0x140004774
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400047be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400047be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400047be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400047be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400047be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400047c0
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004055d0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004055e0]
mov dword [rax], 1
mov rax, qword [0x004055f0]
mov dword [rax], 1
mov rax, qword [0x004055c0]
mov dword [rax], 1
mov rax, qword [0x004054b0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004055b0]
mov dword [0x0040800c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00405570]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00405460]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401e50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]