joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180043240
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180083040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800aae60]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800432b3
mov eax, 0xa
jmp 0x180043346
test esi, esi
je 0x1800432d5
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800432f8
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800432f8
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800432f1
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800432f8
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180049b50
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180043370
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1800aae6c]
mov ebx, edi
test ecx, ecx
je 0x1800434ad
mov rax, qword [0x1800aae60]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800433c8
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800433a0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800434ad
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180043090
mov r8d, dword [0x1800aae6c]
cmp ebx, r8d
jae 0x180043438
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800aae60]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180043431
mov edx, esi
mov ecx, ebx
call fcn.180043240
mov edi, eax
test eax, eax
jne 0x180043438
mov r8d, dword [0x1800aae6c]
inc ebx
cmp ebx, r8d
jb 0x180043400
cmp qword [rsp + 0x20], 0
je 0x1800434ad
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180043499
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004348a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180043460
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800aab48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180043800
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x1800aab40], ebp
je 0x180043857
cmp rbx, 0x20
jae 0x180043840
xor ecx, ecx
jmp 0x180043842
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800aab40], ebp
jne 0x180043836
cmp qword [0x1800aab48], r15
je 0x180043953
test rdi, rdi
jne 0x180043877
mov ecx, esi
call fcn.180043370
mov ebp, eax
jmp 0x180043958
mov ecx, dword [0x1800aae6c]
mov ebx, r15d
test ecx, ecx
je 0x18004389f
mov r8, qword [0x1800aae60]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x1800438a9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180043890
mov ebp, 4
jmp 0x180043958
cmp ebx, 0xffffffff
je 0x18004389f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18004394a
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180043090
mov edx, esi
mov ecx, ebx
call fcn.180043240
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180043958
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180043934
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18004392a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180043900
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800aab48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180043958
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180043958
mov ebp, 2
xchg dword [0x1800aab40], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180048e90
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180048ec3
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180048e60]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18000efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x18000f020
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x18000f015
cmp edi, 0x2d
jne 0x18000f020
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x18000f1b4
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x18000f1bf
movzx r11d, r11b
cmp rbx, rsi
jae 0x18000f0bd
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x18000f07c
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x18000f0bd
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x18000f0bd
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x18000f060
cmp r11d, 0xccccccc
jne 0x18000f0a8
cmp sil, 7
jbe 0x18000f060
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.180059440
jmp 0x18000f1a1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x18000f0da
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x18000f0ea
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x18005f100]
subpd xmm1, xmmword [0x18005f110]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x18000f15c
xorpd xmm1, xmm1
movsd xmm2, qword [0x18005f120]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x18000f138
jnp 0x18000f18a
test r10d, r10d
jns 0x18000f1e8
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x18000f130
mov eax, eax
mov r9, qword [0x180082088]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x18000f1a9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x18005f130]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x18005f140]
jae 0x18000f1e8
test r8b, r8b
jne 0x18000f197
xorpd xmm0, xmmword [0x18005f150]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x18000f18f
jmp 0x18000f197
mov qword [rsp + 0x28], 5
jmp 0x18000f1c8
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1800594e0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x18000f1a1
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1800594e0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x18000f19e
Function at 0x180021ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rsi, rcx
test dl, dl
je 0x180022025
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x18002201d
xor edi, edi
jmp 0x180022048
test al, al
je 0x1800220d3
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov edi, 1
mov r8d, 1
mov rcx, rsi
call fcn.1800385d0
test rax, rax
jne 0x1800220f6
cmp bl, 0x64
jb 0x180022078
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, [0x180061d1a]
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x180022083
mov r8d, 2
cmp bl, 0xa
jae 0x18002208d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x1800220a6
movzx eax, bl
lea rcx, [0x180061d1a]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rsi
mov rsi, r8
call fcn.1800385d0
test rax, rax
je 0x1800220c9
mov edi, 1
jmp 0x1800220f6
mov rax, rsi
add rax, rdi
xor edi, edi
jmp 0x1800220f6
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov edi, 1
nop
mov r8d, 1
mov rcx, rsi
mov rdx, rbx
call fcn.1800385d0
test rax, rax
je 0x1800220e0
mov rdx, rax
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800222a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rsi, rcx
test dl, dl
je 0x1800222d5
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x1800222cd
xor edi, edi
jmp 0x1800222f8
test al, al
je 0x180022383
lea rdx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov edi, 1
mov r8d, 1
mov rcx, rsi
call fcn.180038110
test rax, rax
jne 0x1800223a6
cmp bl, 0x64
jb 0x180022328
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, [0x180061d1a]
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x180022333
mov r8d, 2
cmp bl, 0xa
jae 0x18002233d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x180022356
movzx eax, bl
lea rcx, [0x180061d1a]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rsi
mov rsi, r8
call fcn.180038110
test rax, rax
je 0x180022379
mov edi, 1
jmp 0x1800223a6
mov rax, rsi
add rax, rdi
xor edi, edi
jmp 0x1800223a6
lea rbx, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov edi, 1
nop
mov r8d, 1
mov rcx, rsi
mov rdx, rbx
call fcn.180038110
test rax, rax
je 0x180022390
mov rdx, rax
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x180022550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.180023e10
cmp al, 2
jbe 0x180022572
xor r15d, r15d
jmp 0x1800225b2
xor al, 3
movzx r12d, al
xor r15d, r15d
lea r14, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.1800385d0
test rax, rax
jne 0x1800226be
inc r15
cmp r15, r12
jb 0x180022590
mov ecx, 0xa
lea rax, [0x180061d1a]
cmp edi, 0x2710
jb 0x18002267d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x1800225e0
mov edx, r8d
cmp r8d, 0x63
jbe 0x18002266c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x18002268b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x180022698
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x18002263f
jmp 0x18002266c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.1800385d0
test rax, rax
je 0x1800226c3
mov ebx, 1
mov rsi, rax
jmp 0x1800226c8
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180022870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.180023e10
cmp al, 6
jbe 0x180022892
xor r15d, r15d
jmp 0x1800228d2
xor al, 7
movzx r12d, al
xor r15d, r15d
lea r14, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.180038110
test rax, rax
jne 0x1800229de
inc r15
cmp r15, r12
jb 0x1800228b0
mov ecx, 0xa
lea rax, [0x180061d1a]
cmp edi, 0x2710
jb 0x18002299d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x180022900
mov edx, r8d
cmp r8d, 0x63
jbe 0x18002298c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x1800229ab
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x1800229b8
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x18002295f
jmp 0x18002298c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.180038110
test rax, rax
je 0x1800229e3
mov ebx, 1
mov rsi, rax
jmp 0x1800229e8
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180022d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.180023e10
cmp al, 2
jbe 0x180022d42
xor r15d, r15d
jmp 0x180022d82
xor al, 3
movzx r12d, al
xor r15d, r15d
lea r14, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.180038110
test rax, rax
jne 0x180022e8e
inc r15
cmp r15, r12
jb 0x180022d60
mov ecx, 0xa
lea rax, [0x180061d1a]
cmp edi, 0x2710
jb 0x180022e4d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x180022db0
mov edx, r8d
cmp r8d, 0x63
jbe 0x180022e3c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x180022e5b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x180022e68
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x180022e0f
jmp 0x180022e3c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.180038110
test rax, rax
je 0x180022e93
mov ebx, 1
mov rsi, rax
jmp 0x180022e98
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180023660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.180023e10
cmp al, 6
jbe 0x180023682
xor r15d, r15d
jmp 0x1800236c2
xor al, 7
movzx r12d, al
xor r15d, r15d
lea r14, str.0_JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecember.
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.1800385d0
test rax, rax
jne 0x1800237ce
inc r15
cmp r15, r12
jb 0x1800236a0
mov ecx, 0xa
lea rax, [0x180061d1a]
cmp edi, 0x2710
jb 0x18002378d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x1800236f0
mov edx, r8d
cmp r8d, 0x63
jbe 0x18002377c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x18002379b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x1800237a8
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x18002374f
jmp 0x18002377c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.1800385d0
test rax, rax
je 0x1800237d3
mov ebx, 1
mov rsi, rax
jmp 0x1800237d8
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180028570
Capabilities:
Enumerate gui resources

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
call fcn.18003c920
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], edx
cmp esi, 0x3b9aca00
mov r13, 0xffffffffffffffff
cmovne r13, rdi
mov ebp, 0x3b9ac9ff
cmovne ebp, esi
mov esi, dword [rbx + 8]
lea r14, [rsp + 0x38]
mov rdi, qword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0x28]
mov ebx, 0xff
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ecx, ecx
test rax, rax
setne cl
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [0x1800286a0]
mov rdx, r14
call rdi
test eax, eax
jne 0x18002862b
call fcn.18002b740
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], edx
mov qword [rsp + 0x60], 1
test rax, rax
je 0x18002862b
lea rcx, [rsp + 0x68]
call fcn.18002beb0
mov r12, qword [rsp + 0x50]
cmp qword [rsp + 0x48], 0
jne 0x180028670
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.180035640
mov rcx, r15
call fcn.18003cc40
xor ecx, ecx
cmp rax, r13
setne cl
cmovb ecx, ebx
xor eax, eax
cmp edx, ebp
setne al
cmovb eax, ebx
test cl, cl
cmovne eax, ecx
cmp al, 1
jne 0x1800285d0
jmp 0x18002867a
mov eax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rdx, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180028720
Capabilities:
Get graphical window text

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1c0], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rbx, [rbp - 0x60]
mov r8d, 0x200
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rdi]
mov rdx, rbx
mov r8d, 0x100
call qword [sym.imp.user32.dll_GetWindowTextW]
movsxd r8, eax
cmp r8d, 0x101
jae 0x180028860
lea rdi, [rbp + 0x1a0]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.18003a190
mov rcx, rdi
call fcn.180041ac0
mov r8, rdx
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.180041d00
movabs rax, 0x8000000000000000
cmp qword [rbp - 0x60], rax
jne 0x1800287f3
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x180028833
js 0x180028877
movzx eax, byte [0x180097ba1]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.180003140
test rax, rax
je 0x18002887a
mov r14, rax
jmp 0x180028839
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
je 0x180028820
mov rcx, qword [rbp + 0x1a8]
mov r8d, 1
call fcn.180003150
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov rdx, qword [rbp + 0x1a0]
test rdx, rdx
jne 0x18002880e
jmp 0x180028820
lea rax, str.C:Users_runneradmin_.cargogitcheckouts_rust_hooking_utils_304217ef05c0f44c_a36a365_srcpatchingprocess.rs
mov edx, 0x100
mov rcx, r8
mov r8, rax
call fcn.18005b830
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.18005b270
ud2

Function at 0x180028ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x58
movzx edi, dx
cmp edi, 0x100
ja 0x180029042
mov rsi, rcx
mov ecx, edi
call qword [sym.imp.user32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setns dl
cmp edi, 0x100
je 0x180029079
mov cl, dl
lea ecx, [rcx + rcx*2]
cmp byte [rsi + rdi], cl
jne 0x180029032
movzx eax, ax
shr eax, 0xf
mov cl, 2
sub cl, al
jmp 0x180029039
mov byte [rsi + rdi + 0x100], cl
mov eax, ecx
add rsp, 0x58
pop rdi
pop rsi
ret
lea rax, str.Virtual_keys_cant_have_an_index_of_more_than_256_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, [0x1800673a0]
lea rcx, [rsp + 0x28]
call fcn.18005b3a0
lea r8, [0x180067340]
mov ecx, 0x100
mov edx, 0x100
call fcn.18005b4d0
int3