joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140099e90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp dword [r8 + 0x40], 1
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x140099ebf
xor eax, eax
jmp 0x14009a077
mov ecx, dword [r9 + 0x10]
mov qword [rsp + 0x30], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov esi, eax
lea rax, [rsi - 1]
cmp rax, 0xfe
ja 0x14009a057
mov ecx, dword [rdi + 0x1c]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xd0]
jne 0x14009a057
mov ecx, dword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xc8]
jne 0x14009a057
mov ecx, dword [rdi + 0x24]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, dword [rbx + 0xcc]
jne 0x14009a057
mov eax, dword [rbx + 0x1c]
cmp dword [rdi + 0x28], eax
jne 0x14009a057
mov edx, 1
mov r8b, 0xff
mov rcx, rbx
call fcn.140099070
cmp rsi, qword [rbx + 0x50]
jae 0x140099f45
mov qword [rbx + 0x50], rsi
movzx ecx, word [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x18], ax
movzx eax, byte [rdi + 6]
mov byte [rbx + 0x21], al
movzx eax, byte [rdi + 7]
mov byte [rbx + 0x20], al
mov ecx, dword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 0x240
mov esi, 0x1000
cmp eax, ecx
jb 0x140099f7f
cmp eax, esi
mov ecx, eax
cmova ecx, esi
cmp ecx, dword [rbx + 0xfc]
jae 0x140099f8d
mov dword [rbx + 0xfc], ecx
mov ecx, dword [rdi + 0xc]
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, esi
jb 0x140099fa6
mov ecx, 0x10000
mov esi, eax
cmp eax, ecx
cmova esi, ecx
cmp esi, dword [rbx + 0x100]
jae 0x140099fb4
mov dword [rbx + 0x100], esi
mov ecx, dword [rdi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x58], eax
mov ecx, dword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx + 0x5c], eax
mov dword [rbp + 0x80], 1
mov ecx, dword [rbx + 0x40]
test r14, r14
je 0x14009a03c
lea eax, [rcx - 5]
cmp eax, 1
jbe 0x14009a002
cmp dword [rbx + 0x58], 0
je 0x140099ff7
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b60]
mov rax, qword [rbx + 0x10]
inc qword [rax + 0x2b58]
xor eax, eax
mov dword [rbx + 0x40], 5
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0xa0], rax
mov dword [rbx + 0xac], eax
mov dword [r14], 1
mov qword [r14 + 8], rbx
mov eax, dword [rbx + 0x1fc]
mov dword [r14 + 0x14], eax
xor eax, eax
jmp 0x14009a072
xor eax, eax
mov rdx, rbx
cmp ecx, 1
mov rcx, rbp
sete al
lea r8d, [rax + 3]
call fcn.14008ed00
xor eax, eax
jmp 0x14009a072
xor eax, eax
mov rdx, rbx
mov rcx, rbp
mov dword [rbx + 0x1fc], eax
lea r8d, [rax + 9]
call fcn.14008ed00
lea eax, [r8 - 0xa]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14009dd90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
cmp dword [0x1400f2380], ebx
jne 0x14009de46
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x48]
mov edi, 1
mov dword [0x1400f2380], edi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov dword [0x1400f2384], eax
test eax, eax
je 0x14009ddf9
lea rcx, [0x1400f24e0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
divsd xmm0, qword [0x1400d2f00]
jmp 0x14009de39
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x107b2
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x26], rdi
mov word [rsp + 0x2e], bx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
movsd xmm0, qword [0x1400d2ec8]
shl rcx, 0x20
or rcx, rax
mov qword [0x1400f24e0], rcx
mov rdi, qword [rsp + 0x70]
movsd qword [0x1400f24e8], xmm0
cmp dword [0x1400f2384], ebx
je 0x14009de60
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
jmp 0x14009de7f
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
shl rax, 0x20
or rax, rcx
mov qword [rsp + 0x40], rax
sub rax, qword [0x1400f24e0]
xorps xmm0, xmm0
movabs r9, 0x431bde82d7b634db
cvtsi2sd xmm0, rax
mov rax, r9
divsd xmm0, qword [0x1400f24e8]
cvttsd2si rcx, xmm0
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xf4240
sub ecx, eax
imul eax, ecx, 0x3e8
movsxd r8, eax
movsxd rax, edx
imul rcx, rax, 0x3b9aca00
add r8, rcx
lock xadd qword [0x1400f2388], rbx
test rbx, rbx
jne 0x14009defe
lea rcx, [r8 - 0xf4240]
xor eax, eax
lock cmpxchg qword [0x1400f2388], rcx
mov rbx, rax
cmove rbx, rcx
sub r8, rbx
mov rax, r9
mul r8
shr rdx, 0x12
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a13e0
add rsp, 0x60
pop rbx
ret
Function at 0x14009df20
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x20]
mov rax, rdx
lea r8, [rsp + 0x28]
mov rbx, rcx
xor edi, edi
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor edx, edx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x14009df7d
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14009dfca
jmp 0x14009dfc4
mov r9, qword [rsp + 0x20]
mov rax, r9
test r9, r9
je 0x14009dfca
nop word [rax + rax]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x14009dfb8
mov ecx, dword [rax + 4]
cmp ecx, 2
je 0x14009e00c
test ecx, ecx
jne 0x14009dfb3
cmp qword [rax + 0x10], 0x10
je 0x14009e00c
cmp qword [rax + 0x10], 0x1c
jmp 0x14009dfb6
cmp ecx, 0x17
je 0x14009dfea
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14009df90
mov rcx, r9
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a13e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
movups xmm0, xmmword [rdx + 8]
mov rcx, r9
movups xmmword [rbx], xmm0
mov rdx, qword [rax + 0x20]
movzx r8d, word [rdx + 0x18]
mov word [rbx + 0x12], r8w
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14009dfcf
mov eax, dword [rdx + 4]
test eax, eax
jne 0x14009e02e
movups xmm0, xmmword [0x1400cd758]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14009dfcf
cmp eax, 0xffffffff
jne 0x14009e04e
movups xmm0, xmmword [0x1400cd778]
mov rcx, r9
movups xmmword [rbx], xmm0
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14009dfcf
movups xmm0, xmmword [0x1400cd768]
mov ecx, eax
shr ecx, 8
movups xmmword [rbx], xmm0
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xc], al
mov byte [rbx + 0xe], cl
mov rcx, r9
shr eax, 0x18
mov word [rbx + 0xa], 0xffff
mov byte [rbx + 0xf], al
mov word [rbx + 0x12], di
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
jmp 0x14009dfcf
Function at 0x14009fe10
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [0x1400f18d0]
lea rdx, reloc.WS2_32.dll_accept
xor ebx, ebx
lea rcx, str.test
xor r8d, r8d
or dword [rax + 0x48d0], 3
mov dword [rax + 0x48e4], 0x43480000
mov qword [rax + 0x48e8], 0x43480000
mov dword [rax + 0x48f0], ebx
mov dword [rax + 0x48d4], 2
mov byte [rax + 0x490c], 1
movsd xmm0, qword [0x1400e8140]
movsd qword [rax + 0x48f4], xmm0
mov dword [rax + 0x48d8], 2
movss xmm2, dword [0x1400e8140]
movss xmm1, dword [0x1400e8144]
mulss xmm2, dword [0x1400d2e4c]
mulss xmm1, dword [0x1400d2e4c]
movss dword [rax + 0x3910], xmm2
movss dword [rax + 0x3914], xmm1
call fcn.14004f590
mov rax, qword [0x1400f18f8]
lea r8, [rax + 0xc0]
cmp qword [r8 + 0x18], 0xf
jbe 0x14009fed9
mov r8, qword [r8]
mov r9d, dword [rax + 0xd8]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea rcx, str.Country
mov qword [rsp + 0x48], rbx
call fcn.140086220
mov rax, qword [0x1400f18f8]
lea r8, [rax + 0xe0]
cmp qword [r8 + 0x18], 0xf
jbe 0x14009ff23
mov r8, qword [r8]
mov r9d, dword [rax + 0xf8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea rcx, [0x1400d2dcc]
mov qword [rsp + 0x50], rbx
call fcn.140086220
mov rax, qword [0x1400f18f8]
lea r8, [rax + 0x100]
cmp qword [r8 + 0x18], 0xf
jbe 0x14009ff6d
mov r8, qword [r8]
mov r9d, dword [rax + 0x118]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea rcx, [0x1400d2dc8]
mov qword [rsp + 0x48], rbx
call fcn.140086220
mov rax, qword [0x1400f18f8]
lea r8, [rax + 0x120]
cmp qword [r8 + 0x18], 0xf
jbe 0x14009ffb7
mov r8, qword [r8]
mov r9d, dword [rax + 0x138]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea rcx, [0x1400d2ddc]
mov qword [rsp + 0x40], rbx
call fcn.140086220
mov r8, qword [0x1400f18f8]
lea rax, [0x1400d2244]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x64
add r8, 0x144
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 1
call fcn.140083a80
mov rdx, qword [0x1400f18f8]
add rdx, 0x94
call fcn.140082240
mov r8, qword [0x1400f18f8]
cmp byte [r8 + 0x94], bl
je 0x1400a008d
mov r9, qword [r8 + 0xb0]
add r8, 0x98
cmp qword [r8 + 0x18], 0xf
jbe 0x1400a0062
mov r8, qword [r8]
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea rcx, str.Socks5_Proxy
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rbx
call fcn.140086220
call fcn.140052520
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a13e0
add rsp, 0x60
pop rbx
ret
Function at 0x1400a00b0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400a011b
lea rdx, str.Growtopia.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400a013f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400a00f3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a13e0
add rsp, 0x160
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400a0126

Function at 0x1400a05a0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x388
mov rax, qword [0x1400e8040]
xor rax, rsp
mov qword [rsp + 0x370], rax
nop dword [rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.1400a00b0
cmp eax, dword [rsp + 0x20]
jne 0x1400a05c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1400f2560], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x1400f2568], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [0x1400f2570], rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x30]
mov eax, r9d
sub eax, edx
mov dword [0x1400f2588], edx
mov dword [0x1400f2580], eax
lea rdx, [rsp + 0x40]
mov eax, r8d
mov dword [0x1400f2590], ecx
sub eax, ecx
mov dword [0x1400f2594], r8d
mov rcx, qword [0x1400f2570]
mov r8d, 0x104
mov dword [0x1400f2584], eax
mov dword [0x1400f258c], r9d
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [0x1400f2570]
lea rax, [rsp + 0x40]
mov r8d, 0x104
mov qword [0x1400f2598], rax
lea rdx, [rsp + 0x150]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [0x1400f2568]
lea rax, [rsp + 0x150]
mov r9d, 0x104
mov qword [0x1400f25a0], rax
lea r8, [rsp + 0x260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rax, [rsp + 0x260]
mov qword [0x1400f25a8], rax
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400a13e0
add rsp, 0x388
ret
Function at 0x1400a20e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a212e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a212e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a212e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a212e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a212e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a2130
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140009008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140009008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x18003ba8c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18003ba9f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18003cc58
lea rdx, [0x1800e1648]
lea rcx, [rsp + 0x20]
call fcn.180068c68
int3

Function at 0x18004c560
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800e8438]
xor edx, edx
jmp fcn.18003ba8c

Function at 0x18004e070
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800e8438]
jmp fcn.18003ba8c
Function at 0x1800b361c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.18009ca60
cmp eax, 2
sete dil
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1800b3669
test rbx, rbx
je 0x1800b365d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test dil, dil
je 0x1800b36a0
mov eax, 4
jmp 0x1800b36af
test dil, dil
je 0x1800b36a0
call fcn.1800a149c
test al, al
je 0x1800b36a0
call fcn.1800a177c
test al, al
jne 0x1800b3696
bts esi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, esi
call fcn.1800a1320
jmp 0x1800b36af
call fcn.1800a16c8
mov rcx, rax
jmp 0x1800b3686
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001430
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x50
mov rbx, r9
mov dword [rsp + 0x20], 0xf0000000
mov rdi, r8
mov rsi, rcx
mov r9d, 0x18
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001537
mov r8, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140001537
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140004118
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003f44
Function at 0x140001a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13a8
call fcn.140007ef0
sub rsp, rax
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rsp + 0x1390], rax
mov edx, 0x1571
mov dword [rsp + 0x1384], 0xffffffff
mov dword [rsp + 4], edx
mov ecx, 1
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 4], edx
inc rcx
cmp rcx, 0x270
jb 0x140001ad0
movsd xmm2, qword [0x14000a858]
mov edx, 0x270
movsd xmm4, qword [0x14000a880]
xorps xmm3, xmm3
mov dword [rsp], edx
xorps xmm0, xmm0
mov r10d, 2
cmp edx, 0x270
jne 0x140001b71
lea r8, [rsp + 8]
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140001b30
mov edx, dword [rsp]
jmp 0x140001c4f
cmp edx, 0x4e0
jb 0x140001c4f
xor r8d, r8d
mov eax, dword [rsp + r8*4 + 0x9c4]
mov edx, eax
xor edx, dword [rsp + r8*4 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rsp + r8*4 + 0xff8]
xor ecx, edx
mov dword [rsp + r8*4 + 4], ecx
inc r8
cmp r8, 0xe3
jb 0x140001b80
mov r8d, 0xe3
nop dword [rax]
mov eax, dword [rsp + r8*4 + 0x9c4]
mov edx, eax
xor edx, dword [rsp + r8*4 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rsp + r8*4 - 0x388]
xor ecx, edx
mov dword [rsp + r8*4 + 4], ecx
inc r8
cmp r8, 0x26f
jb 0x140001bd0
mov edx, dword [rsp + 0x1380]
mov eax, dword [rsp + 4]
and edx, 0x80000000
btr eax, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rsp + 0x634]
xor edx, edx
mov dword [rsp + 0x9c0], ecx
mov dword [rsp], edx
mov eax, edx
xorps xmm1, xmm1
inc edx
mov ecx, dword [rsp + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x1384]
xor ecx, eax
mov dword [rsp], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm1, rax
subsd xmm1, xmm3
mulsd xmm1, xmm2
mulsd xmm2, xmm4
addsd xmm0, xmm1
sub r10, 1
jne 0x140001b13
divsd xmm0, xmm2
addsd xmm0, xmm3
mov rcx, qword [rsp + 0x1390]
xor rcx, rsp
call fcn.140006fd0
add rsp, 0x13a8
ret
Function at 0x140003410
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003438
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000345e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003460
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400034b9
test ecx, ecx
jle 0x140003499
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400034b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400034b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400034e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003502
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003518
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003534
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003536
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003572
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000360e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400035ad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400035ee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000360e
cmp rbx, rax
ja 0x1400035c0
test rbx, rbx
je 0x14000360e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret