joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c980
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x140205610]
lea rdx, [0x140110de9]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14004ca78
test eax, eax
je 0x14004c9f8
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14004c9fe
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14004ca78
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x140205620]
call qword [0x1401e7348]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14004ca6a
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14004ca5d
mov rax, qword [0x140205610]
test rax, rax
je 0x14004ca5d
dec dword [rax + 0xf4]
mov rdx, qword [0x140205620]
call qword [0x1401e7350]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14004cb12
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x14010f690]
mov r10d, 0xffffffff
jmp 0x14004caf2
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14004cb87
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14004cad0
cmp rax, 2
jb 0x14004cad0
cmp byte [rcx - 1], 0x23
jne 0x14004cad0
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14004cad0
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14004cb81
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x14010f690]
mov r10d, 0xffffffff
jmp 0x14004cb64
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14004cb87
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14004cb40
cmp r11b, 0x23
jne 0x14004cb40
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x14004cb40
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400613a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movaps xmm6, xmm2
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x1400613d8
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x1400613e6
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x1400613fb
jmp 0x14006154f
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x14006154f
mov eax, dword [rbx]
test al, 2
je 0x14006154f
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
xorps xmm0, xmm0
ucomiss xmm6, xmm0
jae 0x14006142b
movss xmm6, dword [0x14010be30]
jmp 0x140061430
divss xmm6, dword [rcx + 0x14]
movsd xmm0, qword [r9]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm7, xmm0
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.1400504e0
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
shufps xmm6, xmm6, 0
movsd xmm1, qword [rbx + 8]
movsd xmm0, qword [rbx + 0x10]
mulps xmm1, xmm6
addps xmm1, xmm7
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm0, xmm6
addps xmm0, xmm7
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
movlps qword [r9], xmm1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
movss dword [r9 + 0x14], xmm0
movss dword [r9 + 0x18], xmm2
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
movlps qword [r8 + 0x28], xmm0
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
movss dword [rdx + 0x3c], xmm1
shufps xmm0, xmm0, 0x55
movss dword [rdx + 0x40], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140081d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, edx
mov edi, edx
sar edi, 0x1f
and edi, edx
dec edi
mov ebp, 0x8000
jmp 0x140081db1
call fcn.140082420
or r15b, bl
and r15b, r12b
xor bl, 1
movzx ecx, r15b
movzx edx, bl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140081e21
mov rax, r14
test eax, eax
jle 0x140081e24
lea r14, [rax - 1]
xor ecx, ecx
test r14d, r14d
je 0x140081dad
mov edx, dword [rsi + 0xe88]
and edx, ebp
jne 0x140081dad
add eax, 0xfffffffe
mov r12, qword [rsi + 0x20]
movzx ecx, word [r12 + rax*2]
mov r15b, 1
cmp ecx, 9
je 0x140081df1
cmp ecx, 0x20
je 0x140081df1
cmp ecx, 0x3000
je 0x140081df1
xor r15d, r15d
call fcn.140082420
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x140081d90
cmp ecx, 0x20
je 0x140081d90
cmp ecx, 0x3000
je 0x140081d90
mov r12b, 1
jmp 0x140081d90
mov edi, r14d
xor eax, eax
test edi, edi
cmovg eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140081e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x79], 0
mov esi, dword [rcx + 0xc]
je 0x140081f05
inc edi
cmp edi, esi
jge 0x140081fb8
mov r14d, dword [rbx + 0xe88]
jmp 0x140081ea8
or r15b, al
call fcn.140082420
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x140081fb8
inc edi
cmp esi, edi
je 0x140081fb1
test r14w, r14w
js 0x140081e9e
mov r12d, edi
dec r12d
js 0x140081e9e
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x140081eda
cmp ecx, 0x20
je 0x140081eda
cmp ecx, 0x3000
je 0x140081eda
mov r15b, 1
call fcn.140082420
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x140081e80
cmp ecx, 0x20
je 0x140081e80
cmp ecx, 0x3000
je 0x140081e80
xor eax, eax
jmp 0x140081e80
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x140081f43
call fcn.140082420
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140081fb8
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x140081fb5
xor ecx, ecx
test eax, eax
js 0x140081f3f
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x140081f3f
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x140081f81
cmp ecx, 0x20
je 0x140081f81
cmp ecx, 0x3000
je 0x140081f81
xor r12d, r12d
call fcn.140082420
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x140081f20
cmp ecx, 0x20
je 0x140081f20
cmp ecx, 0x3000
je 0x140081f20
mov r13b, 1
jmp 0x140081f20
mov edi, esi
jmp 0x140081fb8
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140086660
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
add rsp, 0x38
ret
Function at 0x14009f4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx], r8
mov qword [r10], rax
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14009f6be
mov r11, qword [rsp + 0x60]
cmp rax, r11
je 0x14009f6be
nop word cs:[rax + rax]
movzx edi, byte [rsi]
test dil, dil
js 0x14009f550
inc rsi
mov qword [rcx], rsi
jmp 0x14009f690
cmp dil, 0xbf
jbe 0x14009f6d4
cmp dil, 0xdf
ja 0x14009f56c
and edi, 0x1f
mov ebx, 1
mov ebp, edi
jmp 0x14009f5b0
cmp dil, 0xef
ja 0x14009f57e
and edi, 0xf
mov ebx, 2
mov ebp, edi
jmp 0x14009f5b0
cmp dil, 0xf7
ja 0x14009f590
and edi, 7
mov ebx, 3
mov ebp, edi
jmp 0x14009f5b0
mov ebp, edi
and ebp, 3
xor ebx, ebx
cmp dil, 0xfc
setb bl
xor ebx, 5
nop word cs:[rax + rax]
mov rax, r9
sub rax, rsi
lea edi, [rbx + 1]
cmp rax, rdi
jl 0x14009f6be
lea rax, [rsi + 1]
mov qword [rcx], rax
movzx edi, byte [rsi + 1]
mov eax, 2
cmp dil, 0xbf
jg 0x14009f6c6
shl ebp, 6
and edi, 0x3f
or edi, ebp
lea r14, [rsi + 2]
mov qword [rcx], r14
cmp ebx, 2
jb 0x14009f690
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f6c6
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 3]
mov qword [rcx], r14
cmp ebx, 3
jb 0x14009f690
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f6c6
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 4]
mov qword [rcx], r14
cmp ebx, 4
jb 0x14009f690
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f6c6
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 5]
mov qword [rcx], r14
cmp ebx, 5
jb 0x14009f690
movzx ebx, byte [r14]
cmp bl, 0xbf
jg 0x14009f6c6
shl edi, 6
and ebx, 0x3f
or edi, ebx
add rsi, 6
jmp 0x14009f53b
cmp byte [rdx], 0
jne 0x14009f698
mov byte [rdx], 1
cmp edi, 0x10ffff
ja 0x14009f6cd
mov rax, qword [r10]
lea rsi, [rax + 2]
mov qword [r10], rsi
mov word [rax], di
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14009f6be
cmp qword [r10], r11
jne 0x14009f530
xor eax, eax
cmp rsi, r8
sete al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, 2
jmp 0x14009f6c6
inc rsi
mov qword [rcx], rsi
mov eax, 2
jmp 0x14009f6c6
Function at 0x14009f840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rcx, r8
cmp r8, r9
je 0x14009f9cb
mov rax, qword [rsp + 0x48]
mov rcx, r8
test rax, rax
je 0x14009f9cb
movzx r10d, byte [rdx]
dec rax
mov rcx, r8
nop dword [rax + rax]
movzx ebx, byte [rcx]
movzx r11d, bl
test r11b, r11b
js 0x14009f890
lea rsi, [rcx + 1]
jmp 0x14009f990
cmp bl, 0xc0
jb 0x14009f9cb
cmp bl, 0xdf
ja 0x14009f8a9
and r11d, 0x1f
mov edi, 1
jmp 0x14009f8e0
cmp bl, 0xef
ja 0x14009f8b9
and r11d, 0xf
mov edi, 2
jmp 0x14009f8e0
cmp bl, 0xf7
ja 0x14009f8c9
and r11d, 7
mov edi, 3
jmp 0x14009f8e0
and r11d, 3
xor edi, edi
cmp bl, 0xfc
setb dil
xor edi, 5
nop dword [rax]
mov ebx, r11d
mov r11, r9
sub r11, rcx
lea esi, [rdi + 1]
cmp r11, rsi
jl 0x14009f9cb
movzx r11d, byte [rcx + 1]
cmp r11b, 0xbf
jg 0x14009f9cb
lea esi, [rdi - 1]
add rsi, rcx
add rsi, 2
shl ebx, 6
and r11d, 0x3f
or r11d, ebx
cmp edi, 2
jb 0x14009f990
movzx ebx, byte [rcx + 2]
cmp bl, 0xbf
jg 0x14009f9cb
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 3
jb 0x14009f990
movzx ebx, byte [rcx + 3]
cmp bl, 0xbf
jg 0x14009f9cb
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 4
jb 0x14009f990
movzx ebx, byte [rcx + 4]
cmp bl, 0xbf
jg 0x14009f9cb
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 5
jb 0x14009f990
movzx edi, byte [rcx + 5]
cmp dil, 0xbf
jg 0x14009f9cb
shl r11d, 6
and edi, 0x3f
or r11d, edi
test r10b, r10b
je 0x14009f9a0
cmp r11d, 0x10ffff
jbe 0x14009f9af
jmp 0x14009f9cb
mov byte [rdx], 1
mov r10b, 1
cmp r11d, 0x10ffff
ja 0x14009f9cb
cmp rsi, rcx
je 0x14009f9cb
add rax, 0xffffffffffffffff
jae 0x14009f9c8
mov rcx, rsi
cmp rsi, r9
jne 0x14009f870
jmp 0x14009f9cb
mov rcx, rsi
sub rcx, r8
cmp rcx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a4140
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [0x140203f28]
test rcx, rcx
je 0x1400a43cd
cmp dword [0x140203f30], 0
je 0x1400a43cd
mov edx, 0x13b0
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [0x14020c638]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400a43cd
mov eax, dword [0x14020c638]
cmp eax, 0xffffffff
je 0x1400a43cd
shr rax, 9
lea rdi, [rax*8 + 0x10]
mov ecx, 8
call fcn.140106c58
mov qword [rbp - 0x38], rax
lea rcx, [rax + 8]
mov qword [rbp - 0x28], rcx
mov qword [rax], rdi
mov qword [rbp - 0x30], rcx
lea rcx, [0x140203f60]
call fcn.140021f70
lea rcx, [0x140203f20]
lea r8, [rbp - 0x38]
mov rdx, rax
call fcn.14001b2f0
mov qword [0x14020c640], rax
test rax, rax
je 0x1400a43cd
mov rcx, qword [0x140203f28]
test rcx, rcx
je 0x1400a43cd
cmp dword [0x140203f30], 0
je 0x1400a43cd
mov edx, dword [0x14020c638]
and edx, 0x1ff
imul rdx, rdx, 0x78
add rax, rdx
mov qword [rsp + 0x20], 0
lea r8, [0x14020c648]
mov r9d, 8
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400a43cd
lea rcx, [0x14020c650]
lea rdx, [0x14020c648]
call fcn.14001a650
test al, al
je 0x1400a43cd
cmp byte [0x140204ac8], 0
jne 0x1400a4297
movss xmm0, dword [rsi + 0x104]
xorps xmm1, xmm1
ucomiss xmm0, xmm1
ja 0x1400a43cd
cmp byte [0x140204ab8], 0
je 0x1400a42e1
mov rcx, qword [0x140203f28]
test rcx, rcx
je 0x1400a42e1
cmp dword [0x140203f30], 0
je 0x1400a42e1
mov edx, 0x2290
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x20]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp - 0x20], 0
je 0x1400a43cd
cmp byte [0x1401752f9], 0
je 0x1400a4315
mov eax, dword [rsi + 0xf0]
cmp eax, dword [0x14020c740]
setne al
cmp dword [0x14020c730], 0
setg cl
and cl, al
mov byte [0x14020c768], cl
cmp cl, 1
je 0x1400a4329
jmp 0x1400a43cd
cmp dword [0x14020c730], 0
setg byte [0x14020c768]
jle 0x1400a43cd
mov eax, dword [0x14020c778]
mov ecx, dword [0x14020d230]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x28]
jg 0x1400a43d5
lea rcx, [rbp - 0x10]
call fcn.1400a4480
movsxd rax, dword [str.ZZ_]
mov rcx, qword [rbp - 0x10]
sub rcx, qword [0x14020c770]
imul rax, rax, 0xf4240
cmp rcx, rax
jl 0x1400a43cd
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400a43c2
mov qword [rsp + 0x20], 0
mov ecx, 2
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_mouse_event]
lea rdx, [0x1400a3fe0]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.1400a4560
mov rcx, rsi
call fcn.1400a4610
cmp dword [rbp - 0x18], 0
jne 0x1400a440b
mov rax, qword [rbp - 0x10]
mov qword [0x14020c770], rax
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14020c778]
call fcn.140106bd8
cmp dword [0x14020c778], 0xffffffff
jne 0x1400a434e
lea rcx, [0x14020c770]
call fcn.1400a4480
lea rcx, [0x14020c778]
call fcn.140106b6c
jmp 0x1400a434e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
Function at 0x1400a4560
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov ecx, 8
call fcn.140106c58
mov rbx, rax
mov qword [rax], rdi
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x1400a4800]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1400a45c4
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 8], rbx
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400fe570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.1400fe2a0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe2a0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x1400fe6fb
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x1400fe605
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.1400fe340
jmp 0x1400fe6ec
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x1400fe6d9
mov rcx, rsi
call fcn.1400fe2a0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe2a0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rbp, [rsi + 0x18]
test al, al
je 0x1400fe6b9
nop
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x1400fe6c0
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.1400fe340
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x1400fe6dd
mov rcx, rsi
mov edi, ebx
call fcn.1400fe2a0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.1400fe2a0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x1400fe650
mov edx, 0xfffd
jmp 0x1400fe6df
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
jmp 0x1400fe6dd
lea rbp, [rsi + 0x18]
mov edx, edi
mov rcx, rbp
call fcn.1400fe340
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x140107484
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401074ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401074ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401074ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401074ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1401074ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401074d0
xor al, al
add rsp, 0x28
ret

Function at 0x14010803c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140108076
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14010807b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1401080c4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14011d850]
cmp byte [rcx + rax], 0
je 0x1401080c4
dec r8
sub rdx, 1
jne 0x1401080aa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140001800
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1260
call fcn.140005280
sub rsp, rax
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x1250], rax
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140001944
mov ebp, dword [rsp + 0x30]
xor edi, edi
shr ebp, 2
test ebp, ebp
je 0x140001944
lea rbx, [rsp + 0x40]
mov esi, dword [rbx]
test esi, esi
je 0x140001936
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x140006800]
lea rcx, [rsp + 0x1054]
xor edx, edx
mov dword [rsp + 0x1050], eax
mov r8d, 0x1f4
movaps xmmword [rsp + 0x1040], xmm0
call sub.VCRUNTIME140.dll_memset
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001936
lea r9, [rsp + 0x28]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400018f2
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1040]
mov r9d, 0x208
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rdx, [rsp + 0x1040]
lea rcx, str.RobloxPlayerBeta.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000192d
mov r8d, dword [rbx]
mov rdx, qword [0x14000a970]
mov rcx, qword [0x14000a968]
call fcn.140004330
mov rdx, qword [0x14000a970]
cmp rax, rdx
je 0x14000196f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rbx, 4
cmp edi, ebp
jb 0x140001862
xor al, al
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.140004430
lea r11, [rsp + 0x1260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ebx, dword [rsp + rdi*4 + 0x40]
mov r8d, ebx
mov rcx, qword [0x14000a968]
mov dword [rsp + 0x28], ebx
call fcn.140004330
mov r9, qword [0x14000a970]
cmp rax, r9
jne 0x1400019fb
mov rcx, qword [0x14000a968]
mov rax, r9
sub rax, rcx
sar rax, 2
cmp rax, 0x32
jb 0x1400019ca
lea rdx, [rcx + 4]
sub r9, rdx
mov r8, r9
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [0x14000a970]
add r9, 0xfffffffffffffffc
mov qword [0x14000a970], r9
cmp r9, qword [0x14000a978]
je 0x1400019ee
mov dword [r9], ebx
mov rcx, rsi
add qword [0x14000a970], 4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140001946
lea r8, [rsp + 0x28]
mov rdx, r9
call fcn.140001b30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140001946