joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401276a8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1402809a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
cmp r8, 0x20
jne 0x14012774e
mov rcx, qword [rcx + 0x40]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
lea rdx, [rsp + 0x20]
add eax, 4
mov rcx, rbx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x2c]
add eax, 0x17
mov dword [rsp + 0x24], eax
call fcn.1401288cc
mov rcx, rbx
call fcn.140127b60
mov rcx, qword [rbx + 0x40]
mov edx, 0xec1a
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140194eb0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
cmp dword [rcx + 0x458], esi
jne 0x14012776d
cmp r8, 0x79
je 0x140127764
cmp r8, 0x12
jne 0x140127769
mov esi, 1
mov eax, esi
jmp 0x14012772d
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, reloc.WS2_32.dll_recv
shr ebp, 0xf
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
cmp rdi, 0x12
je 0x1401277a2
cmp rdi, 0x79
jne 0x14012771c
cmp qword [0x14028e608], rsi
jne 0x14012772b
test byte [rbx + 0x478], 2
jne 0x14012772b
cmp rdi, 0x12
je 0x1401277d8
cmp rdi, 0x79
jne 0x14012772b
test ebp, ebp
jne 0x14012772b
test eax, eax
jne 0x14012772b
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140018cc4
cmp rax, rbx
jne 0x1401277fd
bt r15, 0x1e
jb 0x1401277fd
cmp rdi, 0x79
jne 0x14012780d
mov rcx, r14
jmp 0x140127806
cmp rdi, 0x79
jne 0x14012780d
mov rcx, rbx
call fcn.14001f1ac
jmp 0x14012782d
cmp dword [rbx + 0x414], esi
jge 0x14012782d
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov edx, 0xec1a
mov r8d, 0xc8
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
jmp 0x14012772d
Function at 0x14015b44c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1402903b8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140287a24]
test eax, eax
je 0x14015b497
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x14015b4a0
call fcn.14001ebbc
test eax, eax
je 0x14015b4bc
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14015b4c4
xor eax, eax
jmp 0x14015b521
test rbx, rbx
jne 0x14015b4e4
lea rcx, str.ChooseColorW
call fcn.140046c90
mov rbx, rax
test rax, rax
je 0x14015b4ef
mov qword [0x1402903b8], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14015b504
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015b506
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14015b51f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140162df0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
call fcn.14001f0c0
test eax, eax
je 0x140162f24
cmp dword [rbx + 0xb28], 0
je 0x140162e40
and dword [rbx + 0x124], 0
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
jmp 0x140162f29
call fcn.140036c74
mov rcx, qword [rax + 8]
call fcn.140015a5c
nop
mov rcx, qword [rbx + 0xb30]
sub rcx, 0x18
call fcn.14000272c
add rax, 0x18
mov qword [rsp + 0x60], rax
cmp dword [rax - 0x10], 0
jne 0x140162e7b
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14001934c
lea rdx, [rbx + 0xb38]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.14000ea54
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140162ece
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rbx + 0xb2c], 1
and dword [rbx + 0x124], 0
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140162f1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x58]
call fcn.140016494
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x14016e138
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov rdi, rcx
xor eax, eax
cmp qword [0x14028b398], rax
setne al
test eax, eax
jne 0x14016e169
call fcn.14001240c
int3
lea r8, [rbp + 0x77]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x14016e182
xor eax, eax
jmp 0x14016e2f0
lea rcx, [rbp + 0x7f]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x14016e17b
mov dword [rbp - 0x59], 0x67
mov edx, 0x18
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14016e1ba
call fcn.14001240c
int3
mov rax, qword [rbp + 0x77]
mov qword [rbx + 0x10], rax
mov rdx, qword [rbp + 0x77]
mov rcx, qword [0x14028b398]
call fcn.140032be8
mov qword [rbx + 8], rax
and qword [rbx], 0
mov qword [rbp - 0x29], rbx
mov rax, qword [rdi]
mov r8, rbx
lea rdx, [rbp + 0x6f]
mov rcx, rdi
call qword [rax + 0x2c8]
nop
mov rax, qword [rbp + 0x6f]
mov edx, dword [rax - 0x10]
test edx, edx
jns 0x14016e208
mov ecx, 0x80070057
call fcn.1400026dc
int3
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x14016e229
lea rcx, [rbp + 0x6f]
call fcn.140002e10
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x41], rax
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x2d0]
mov dword [rbp - 0x35], eax
mov rax, qword [rdi]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x2d0]
mov dword [rbp - 0x31], eax
mov dword [rbp - 0x2d], 1
movups xmm0, xmmword [rbp - 0x59]
movaps xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm1
movups xmm0, xmmword [rbp - 0x39]
movaps xmmword [rbp + 0x17], xmm0
movsd xmm1, qword [rbp - 0x29]
movsd qword [rbp + 0x27], xmm1
mov qword [rbp - 0x11], 0xffffffffffff0002
mov qword [rbp - 0x19], 0xffffffffffff0000
lea r9, [rbp - 0x19]
xor r8d, r8d
mov edx, 0x1132
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rax
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14016e2eb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401708a0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov bl, r8b
movzx ebp, dx
mov rdi, rcx
call qword [rax + 0x2f0]
mov ecx, ebp
mov edx, 2
mov esi, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test bl, bl
jne 0x1401708f7
test esi, esi
js 0x1401708f7
cmp ax, 0x20
je 0x1401708e9
cmp bp, 0x71
jne 0x1401708f7
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x320]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140194150
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140291550]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140287a24]
test eax, eax
je 0x14019419b
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140287a24]
test eax, eax
jne 0x1401941a4
call fcn.14001ebbc
test eax, eax
je 0x1401941c0
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14027f448]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401941c8
xor eax, eax
jmp 0x140194225
test rbx, rbx
jne 0x1401941e8
lea rcx, str.PrintDlgW
call fcn.140046c90
mov rbx, rax
test rax, rax
je 0x1401941f3
mov qword [0x140291550], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140194208
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14019420a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140194223
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140194600
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140194691
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140194691
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140194691
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140194675
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14019466f
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140194677
add rdx, 0x28
jmp 0x140194654
xor edx, edx
test rdx, rdx
jne 0x140194680
xor al, al
jmp 0x140194697
test dword [rdx + 0x24], 0x80000000
je 0x14019468d
xor al, al
jmp 0x140194697
mov al, 1
jmp 0x140194697
xor al, al
jmp 0x140194697
add rsp, 0x18
ret
Function at 0x14019730c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402809a0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, rcx
xor r15d, r15d
cmp qword [rcx + 0x68], r15
je 0x140197496
cmp byte [rcx + 0x72], r15b
je 0x140197496
mov rax, qword [rcx]
mov edi, 0xffff
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.14019546c
movzx edx, di
mov rcx, r12
call rbx
cmp di, ax
jne 0x140197383
xor al, al
jmp 0x140197498
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], rdx
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], r15b
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, r8
lea r14, [rbp - 0x30]
cmovae r14, r8
mov rsi, qword [r12 + 0x68]
mov rdx, qword [rsi]
mov rbx, qword [rbp - 0x20]
add rbx, r9
mov rdi, qword [rdx + 0x40]
mov rcx, rdi
call fcn.14019546c
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [r12 + 0x74]
mov rcx, rsi
call rdi
mov ecx, eax
test eax, eax
je 0x140197407
sub ecx, 1
jne 0x14019747b
jmp 0x14019740c
mov byte [r12 + 0x72], r15b
lea rax, [rbp - 0x30]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, r8
mov rbx, qword [rbp - 0x40]
sub rbx, rax
je 0x140197457
lea rcx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rcx, r8
mov r9, qword [r12 + 0x80]
mov r8, rbx
mov edx, 1
call fcn.14019ddf0
cmp rbx, rax
jne 0x140197483
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
cmp byte [r12 + 0x72], r15b
je 0x140197480
test rbx, rbx
jne 0x1401973b2
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.1400063f8
jmp 0x1401973aa
cmp ecx, 2
jne 0x140197483
mov r15b, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.140005fcc
mov al, r15b
jmp 0x140197498
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140194eb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401ae8c4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401ae698
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401ae698
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401ae698
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401ae698
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401ae698
cmp dword [rcx + 0x84], 0xe
jbe 0x1401ae698
cmp dword [rcx + 0xf8], esi
je 0x1401ae698
mov ecx, r14d
call fcn.1401ae7e0
mov ecx, 2
call fcn.1401b03bc
nop
cmp byte [0x140292780], 0
jne 0x1401ae762
mov r15d, 1
mov eax, r15d
xchg dword [0x140292774], eax
test ebx, ebx
jne 0x1401ae70b
mov rdi, qword [0x1402809a0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140292778]
cmp rcx, rax
je 0x1401ae702
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140188f40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140292790]
jmp 0x1401ae717
cmp ebx, r15d
jne 0x1401ae71d
lea rcx, [0x1402927a8]
call fcn.1401b012c
nop
test ebx, ebx
jne 0x1401ae734
lea rdx, [0x1401d0a68]
lea rcx, [0x1401d0a48]
call fcn.1401ae558
lea rdx, [0x1401d0a78]
lea rcx, [0x1401d0a70]
call fcn.1401ae558
movzx eax, byte [0x140292780]
test esi, esi
cmove eax, r15d
mov byte [0x140292780], al
jmp 0x1401ae762
mov ecx, 2
call fcn.1401b0410
test esi, esi
jne 0x1401ae779
mov ecx, r14d
call fcn.1401ae794
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401ae628
Function at 0x1401b3f58
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401b3dbe
call fcn.14019cda4
mov dword [rax], socket
call fcn.14019cc54
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401b3da0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401b3da0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1401b3df0
lock or dword [rax + 0x14], 0x10
jmp 0x1401b3da0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401b3e0d
mov rcx, qword [rbp + 0x20]
call fcn.1401b45ec
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1401b3e22
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1401b3e28
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1401ac95c
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401b85a0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1401b3e7b
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1401b3da0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401b3ee7
mov rcx, qword [rbp + 0x20]
call fcn.1401ac95c
cmp eax, 0xffffffff
je 0x1401b3ece
mov rcx, qword [rbp + 0x20]
call fcn.1401ac95c
cmp eax, 0xfffffffe
je 0x1401b3ece
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1401ac95c
movsxd rdi, eax
lea r15, [0x140292b90]
mov rcx, rbx
sar rdi, 6
call fcn.1401ac95c
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1401b3ed5
lea rax, [0x140280f70]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401b3ee7
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1401b3f1d
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401b3f19
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401b3f19
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1401b3f3b
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1401b3f46
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1401b3da5
jmp 0x1401b3d6c
Function at 0x140cce058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140cce1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140cce089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cce06f
add dl, dl
jne 0x140cce096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cce0f6
xor eax, eax
add dl, dl
jne 0x140cce0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140cce1ad
add dl, dl
jne 0x140cce0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cce0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cce0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cce0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140cce0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140cce07e
mov eax, 1
add dl, dl
jne 0x140cce106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140cce113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cce0fb
sub eax, ebx
mov ebx, 1
jne 0x140cce14c
mov ecx, 1
add dl, dl
jne 0x140cce12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cce13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cce123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cce07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140cce168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140cce175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140cce15d
cmp eax, 0x7d00
jae 0x140cce19b
cmp eax, 0x500
jb 0x140cce196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cce07e
cmp eax, 0x7f
ja 0x140cce19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140cce07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140cce1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140cce07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002d50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d9c
xor al, al
add rsp, 0x28
ret
Function at 0x14061a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14061a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14061a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061a06f
add dl, dl
jne 0x14061a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061a0f6
xor eax, eax
add dl, dl
jne 0x14061a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14061a1ad
add dl, dl
jne 0x14061a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14061a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14061a07e
mov eax, 1
add dl, dl
jne 0x14061a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14061a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061a0fb
sub eax, ebx
mov ebx, 1
jne 0x14061a14c
mov ecx, 1
add dl, dl
jne 0x14061a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14061a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14061a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14061a15d
cmp eax, 0x7d00
jae 0x14061a19b
cmp eax, 0x500
jb 0x14061a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061a07e
cmp eax, 0x7f
ja 0x14061a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14061a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14061a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14061a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20