joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c58f0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x007668e8], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x0058ea80]
mov dl, 1
call fcn.005901a0
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.00590450
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.00411c50
lea rcx, [rbp + 0x30]
lea rdx, [0x006c5ad8]
mov r8, qword [rbp + 0x28]
call fcn.00411f80
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00590840
test al, al
je 0x6c5a2a
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x006c5b4c]
call fcn.005914a0
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.004495c0
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x6c5a2a
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x006c5b64]
call fcn.00421cc0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x6c5a20
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x6c5a20
mov rcx, qword [rbp + 0x90]
call fcn.006c5860
test eax, eax
je 0x6c5a04
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x6c5a0e
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x007668e8], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040d4c0
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.004108b0
lea rcx, [rbp + 0x68]
call fcn.004107d0
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x6c5be0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x6c5c3b
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6c5c18
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6c5c2c
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x6c5c3b
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6dbe10
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006dbe74]
mov eax, ecx
test ax, 4
je 0x6dbe29
or bx, 1
mov eax, ecx
test ax, 8
je 0x6dbe35
or bx, 4
mov eax, ecx
test ax, 1
je 0x6dbe41
or bx, 8
mov eax, ecx
test ax, 2
je 0x6dbe4d
or bx, 0x10
test cx, 0x10
je 0x6dbe58
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6dbe6b
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6dbe80
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006dbecc]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6dbea3
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6dbeb6
or si, 4
test ebx, 0x20000000
je 0x6dbec2
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6eb5d0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6eb7dd
mov rcx, qword [0x004cfa48]
mov dl, 1
call fcn.0050d330
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.004107d0
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor eax, eax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov ecx, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], ecx
jg 0x6eb7c0
mov ecx, dword [rbp + 0x3c]
sub ecx, eax
add ecx, 1
mov dword [rbp + 0x3c], ecx
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax]
call fcn.006b30c0
test al, al
je 0x6eb7a7
mov rax, qword [rbp + 0x60]
movzx eax, word [rax]
mov dword [rbp + 0x48], eax
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x70]
lea rdx, [0x006eb848]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.0043a3b0
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x6eb7a7
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006eb8b6]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6eb79a
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411c50
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r8, qword [r8]
mov rax, qword [rax]
call qword [rax + 0x80]
mov rax, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rax]
cmp rax, qword [rcx + 0x90]
jne 0x6eb79a
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00411c50
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey
add qword [rbp + 0x60], 8
mov eax, dword [rbp + 0x3c]
sub eax, 1
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
test eax, eax
jne 0x6eb683
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x49], 0
mov rcx, rax
mov dl, 1
call fcn.0050d1c0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.004107d0
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6ec8e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x0077a288]
cmp byte [rax + 0x159], 0
jne 0x6ec97e
cmp qword [0x0077a2c8], 0
jne 0x6ec925
call sub.kernel32.dll_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x00768cd8]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x0077a2c8], rax
cmp qword [0x0077a2c0], 0
jne 0x6ec945
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x0077a2c0], rax
cmp qword [0x0077a2d0], 0
jne 0x6ec97e
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x00768cd0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x0077a2d0], rax
add rsp, 0x48
ret

Function at 0x6edd80
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2e0]
test rax, rax
je 0x6ede5e
cmp dword [rbx + 0x128], 0
jne 0x6ede54
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006edc80]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6ede54
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6ede02
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6ede53
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.005053c0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6ede13
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6ee2d0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
mov rax, qword [0x0077a288]
cmp qword [rax + 0x2e0], 0
je 0x6ee494
test sil, sil
jne 0x6ee3bc
cmp dword [rbx + 0x138], 0
jne 0x6ee3ad
mov rcx, rbx
call fcn.006f2ae0
lea rcx, [0x006ee190]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6ee36f
mov rax, qword [0x0077a288]
cmp byte [rax + 0x193], 0
je 0x6ee36f
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6ee349
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ee36e
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor edx, edx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ee351
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ee3ac
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005053c0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ee380
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6ee494
cmp dword [rbx + 0x138], 0
jle 0x6ee494
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6ee494
cmp qword [rbx + 0xa8], 0
je 0x6ee433
mov rax, qword [0x0077a288]
cmp byte [rax + 0x193], 0
je 0x6ee433
mov rax, qword [rbx + 0x1a0]
test rax, rax
je 0x6ee40a
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6ee432
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ee412
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6ee470
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005053c0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6ee444
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006d3d78]
call fcn.00414fa0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6ef7b0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6ef81c
cmp byte [rbx + 0x193], 0
jne 0x6ef81c
mov rcx, qword [rbx + 0x2e0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.00410ad0
xor eax, eax
mov rcx, qword [rsi]
test rcx, rcx
je 0x6ef807
mov eax, dword [rcx - 4]
test eax, eax
jne 0x6ef82b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410e40
jmp 0x6ef82b
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.00410e40
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6fdf30
Capabilities:
Hide graphical window

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
cmp qword [rbx + 0xd0], 0
jne 0x6fdfeb
mov rcx, qword [rbx + 0x10]
call fcn.006a9670
mov rcx, qword [0x00608058]
mov dl, 1
mov r8, rax
call fcn.006a0210
mov qword [rbx + 0xd0], rax
mov rsi, qword [rbx + 0xd0]
mov rcx, rsi
xor edx, edx
call fcn.00610070
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006fd5b0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xd0]
call fcn.006a9670
mov rdi, rax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.006a9670
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xf0], 0
jne 0x6fe09a
mov rcx, qword [rbx + 0x10]
call fcn.006a9670
mov rcx, qword [0x00608058]
mov dl, 1
mov r8, rax
call fcn.006a0210
mov qword [rbx + 0xf0], rax
mov rsi, qword [rbx + 0xf0]
mov rcx, rsi
mov dl, 1
call fcn.00610070
lea rax, [rsi + 0x4d8]
mov qword [rax + 8], rbx
lea rcx, [0x006fd610]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xf0]
call fcn.006a9670
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xf0]
call fcn.006a9670
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6fe142
mov rcx, qword [rbx + 0x10]
call fcn.006a9670
mov rcx, qword [0x00609100]
mov dl, 1
mov r8, rax
call fcn.006a0210
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov byte [rsi + 0x4a8], 1
mov rcx, qword [rbx + 0xe0]
call fcn.006a9670
mov rdi, rax
mov rcx, rsi
mov edx, 2
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov r13d, eax
mov rcx, rsi
mov edx, 3
mov rax, qword [rsi]
call qword [rax + 0x1c0]
mov rcx, rdi
xor edx, edx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.006a9670
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r13
ret

Function at 0x710240
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x00710290]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x710260
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x710273
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x710286
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14115f6dc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14115f6e6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14115f70f
pop rbp
sub rbp, 0x33
sub rbp, 0x115f6dc
sub rsp, 0x20
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x14115f72e
mov rax, 0x115f6dc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
add dword [rax + 1], ecx
call 0xc5d67884
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rbx], 6
add byte [rax], al
mov rdx, 0xfffffffff08471ab
xor byte [rax], dl
inc rax
dec rcx
jne 0x14115f74d
test edx, esi
invalid
jmp 0x14115f764
jrcxz 0x14115f788
and byte [rdx], spl
xchg edi, eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f799
push 0xffffffffffffffa3
stosb byte [rdi], al
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f720
jrcxz 0x14115f7e5
imul ebp, dword [rbx + rbp*4 + 0x6ce3abab], 0x69
sub dword [rbx + 0x5ce3abab], 0x49
jrcxz 0x14115f734
push 0x20
sub ah, byte [rdi - 0x1c545455]
stosb byte [rdi], al
sti
sti
jrcxz 0x14115f7ab
xchg ebx, eax
adc bl, byte [rdx - 0x54545455]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f7b4
or dl, byte [rsi - 0x545454b1]
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f756
stosb byte [rdi], al
jrcxz 0x14115f7c0
std
stosb byte [rdi], al
in al, 0xf8
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
scasb al, byte [rdi]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
mov ebp, 0x6aababab
test eax, 0x2ae3ba9a
stosd dword [rdi], eax
push 0x43
test eax, 0x2ae3ba9a
push 0xffffffffffffffaf
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f823
invalid
jrcxz 0x14115f7f9
or dl, byte [rsi - 0x545454b1]
stosd dword [rdi], eax
stosd dword [rdi], eax
jrcxz 0x14115f79b
scasb al, byte [rdi]
stosd dword [rdi], eax
stosd dword [rdi], eax
stosd dword [rdi], eax
test eax, 0x43f9abab
test eax, 0x43f9abab
invalid
sub edx, dword [rax + 0x43]
movsb byte [rdi], byte [rsi]
invalid
Function at 0x140028974
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c284
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c284
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028ac4
cmp rax, 0xffffffffffffffff
je 0x140028ac4
xor edi, edi
test rbp, rbp
jle 0x140028a6f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb98
mov rbx, rax
test rax, rax
jne 0x1400289fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028a65
mov edx, 0x8000
mov ecx, r14d
call fcn.140019be8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cf60
cmp eax, 0xffffffff
je 0x140028a45
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a0c
mov edx, r15d
mov ecx, r14d
call fcn.140019be8
jmp 0x140028a65
cmp byte [rsi + 0x38], dil
je 0x140028a5c
cmp dword [rsi + 0x34], 5
jne 0x140028a5c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028a65
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a948
jmp 0x140028ad8
jns 0x140028ad8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c284
cmp rax, 0xffffffffffffffff
jne 0x140028a90
cmp byte [rsi + 0x30], dil
je 0x140028ad8
mov edi, dword [rsi + 0x2c]
jmp 0x140028ad8
mov ecx, r14d
call fcn.14001871c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028ad8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028ad1
mov eax, dword [rsi + 0x2c]
jmp 0x140028ad6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c284
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001d28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d72
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d74
xor al, al
add rsp, 0x28
ret
Function at 0x1405e3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405e31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405e3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405e306f
add dl, dl
jne 0x1405e3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405e30f6
xor eax, eax
add dl, dl
jne 0x1405e30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405e31ad
add dl, dl
jne 0x1405e30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405e30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405e30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405e30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405e30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405e307e
mov eax, 1
add dl, dl
jne 0x1405e3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405e3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405e30fb
sub eax, ebx
mov ebx, 1
jne 0x1405e314c
mov ecx, 1
add dl, dl
jne 0x1405e312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405e313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405e3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405e307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405e3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405e3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405e315d
cmp eax, 0x7d00
jae 0x1405e319b
cmp eax, 0x500
jb 0x1405e3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405e307e
cmp eax, 0x7f
ja 0x1405e319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405e307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405e31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405e307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800033e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000343d
lea rbx, [0x1800b1710]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180003424
cmp r10, 2
jb 0x180003424
cmp byte [r9], r8b
jne 0x180003424
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180003400
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000347f
lea rbx, [0x1800b1710]
cmp r8b, 0x23
jne 0x180003463
cmp byte [r9], r8b
jne 0x180003463
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180003450
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180003640
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x18000365e
mov qword [r8], r14
lea rdx, [0x1800b1220]
call fcn.180003490
mov rbx, rax
test rax, rax
jne 0x180003683
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800037af
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800037af
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800037af
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800037af
cmp rdi, 0xffffffffffffffff
je 0x1800037af
mov rcx, rdi
call fcn.1800062f0
mov rbp, rax
test rax, rax
je 0x1800037af
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18000379c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1800c7420]
test r8, r8
je 0x180003791
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180003786
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800037b8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800037aa
mov qword [rsi], rdi
mov rax, rbp
jmp 0x1800037ba
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret