joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021008
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdx
mov rdx, rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ebx, eax
jne 0x10002105b
cmp dword [rsp + 0x30], 4
jne 0x10002105b
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x100021df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
imul r9d, dword [rsp + 0x50]
mov rbx, rdx
mov rbp, rcx
mov edi, r9d
add rdi, rdx
cmp rdx, rdi
jae 0x100021f21
mov r13d, dword [rsp + 0x50]
mov r14d, dword [rsp + 0x58]
mov eax, r8d
lea rsi, [rdx + rax*4]
mov edx, 0xffc03fc0
lea r12, [r13 + r13]
mov r15, rbx
cmp rbx, rsi
jae 0x100021f0f
mov r14, rbp
mov r11d, dword [r15 + 4]
mov r9d, dword [r15]
mov r10d, dword [r13 + r15]
mov r8d, dword [r13 + r15 + 4]
mov ecx, r9d
mov eax, r11d
shr eax, 2
shr ecx, 2
add r15, 8
and eax, edx
and ecx, edx
add ecx, eax
mov eax, r10d
shr eax, 2
and eax, edx
add ecx, eax
mov eax, r8d
shr eax, 2
and eax, edx
lea edx, [rcx + rax - 0x7fff80]
mov ecx, r10d
shr r10d, 2
and ecx, 0xff00ff
mov eax, r8d
shr r8d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r9d
shr r9d, 2
and eax, 0xff00ff
add ecx, eax
mov eax, r11d
shr r11d, 2
and eax, 0xff00ff
lea ecx, [rcx + rax + 0x20002]
shr ecx, 2
xor edx, ecx
mov ecx, 0x3fc03fc0
and r10d, ecx
and edx, 0xff00ff
and r8d, ecx
add r10d, r8d
and r9d, ecx
and r11d, ecx
add r10d, r9d
lea eax, [r10 + r11 + 0x800080]
xor edx, eax
mov dword [r14], edx
add r14, 4
mov edx, 0xffc03fc0
cmp r15, rsi
jb 0x100021e4d
mov r14d, dword [rsp + 0x58]
add rbx, r12
add rbp, r14
add rsi, r12
cmp rbx, rdi
jb 0x100021e3e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000220cc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x10002a110]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor ebx, ebx
cmp dword [0x100034cc0], ebx
je 0x100022104
cmp qword [0x100034ca8], rbx
setne bl
jmp 0x100022276
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x90
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov r11d, ebx
sete r11b
lea rcx, [0x100015220]
mov dword [0x100034cc4], r11d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x100015230]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034c88], rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x100015248]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034c90], rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x100015260]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034c98], rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x100015270]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034ca0], rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x100015288]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034cb0], rax
cmp rax, rbx
je 0x10002223b
lea rdx, [0x1000152a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034cb8], rax
cmp rax, rbx
je 0x10002223b
mov rcx, rdi
lea rdx, [0x1000152b8]
cmp dword [0x100034cc4], ebx
jne 0x100022222
lea rdx, [0x1000152c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100034ca8], rax
cmp rax, rbx
je 0x10002223b
mov ebx, 1
jmp 0x10002226c
mov qword [0x100034c88], rbx
mov qword [0x100034c90], rbx
mov qword [0x100034c98], rbx
mov qword [0x100034ca0], rbx
mov qword [0x100034ca8], rbx
mov qword [0x100034cb0], rbx
mov qword [0x100034cb8], rbx
mov dword [0x100034cc0], 1
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1000270a0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x1000224f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x10002264e
mov qword [rbx + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rbx
mov rdx, rax
call fcn.100022950
mov rcx, rbx
mov dword [rbx + 8], eax
mov rax, qword [rbx]
call qword [rax + 0x18]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0xa8]
mov rcx, rbx
call fcn.100022660
cmp dword [rbx + 8], 1
je 0x10002255d
cmp dword [rbx + 8], 3
je 0x10002255d
cmp dword [rbx + 8], 2
jne 0x100022570
mov rcx, rbx
call fcn.100022b40
test eax, eax
jns 0x100022570
mov byte [rbx + 0x31], 1
mov dword [rbx + 0x34], eax
cmp dword [rbx + 8], 1
jne 0x1000225d0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x400
mov byte [rbx + 0x28], 1
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1000225c0
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1000225c8
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [rbx + 0x28], 0
jne 0x100022591
jmp 0x1000225d0
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, 0x20
call sub.d3d9.dll_Direct3DCreate9
mov qword [rbx + 0x2458], rax
test rax, rax
jne 0x1000225ef
mov dword [rbx + 0x34], 0x82000001
jmp 0x100022648
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
jns 0x100022601
mov dword [rbx + 0x34], eax
jmp 0x100022648
mov rcx, rbx
call fcn.100023f14
test eax, eax
js 0x1000225fc
xor eax, eax
cmp dword [rbx + 0x2450], eax
jbe 0x100022641
lea rcx, [rbx + 0x2408]
mov rdx, qword [rcx]
cmp byte [rdx + 0x2ba1], 0
jne 0x10002264c
cmp byte [rdx + 0x2ba3], 0
jne 0x10002264c
inc eax
add rcx, 8
cmp eax, dword [rbx + 0x2450]
jb 0x10002261e
mov dword [rbx + 0x34], 0x82000003
mov byte [rbx + 0x31], 1
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x100022950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x10002a110]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov qword [rcx + 0x18], rsi
movzx eax, word [rdx]
cmp ax, 0x22
jne 0x1000229b0
jmp 0x100022991
cmp ax, 0x22
je 0x1000229bb
add rbx, 2
movzx eax, word [rbx]
cmp ax, si
jne 0x10002298b
cmp ax, 0x22
jmp 0x1000229b9
cmp ax, 0x20
je 0x1000229bb
add rbx, 2
mov ax, word [rbx]
cmp ax, si
jne 0x1000229a3
cmp word [rbx], 0x20
jne 0x1000229bf
add rbx, 2
movzx eax, word [rbx]
cmp ax, si
je 0x100022b13
cmp ax, 0x2f
je 0x1000229e3
cmp ax, 0x2d
je 0x1000229e3
add rbx, 2
mov ax, word [rbx]
cmp ax, si
jne 0x1000229cb
cmp word [rbx], si
je 0x100022b13
movzx eax, word [rbx + 2]
cmp eax, 0x43
je 0x100022a9f
cmp eax, 0x50
je 0x100022a2a
cmp eax, 0x54
je 0x100022a20
cmp eax, 0x63
je 0x100022a9f
cmp eax, 0x70
je 0x100022a2a
cmp eax, 0x74
je 0x100022a20
mov eax, 2
jmp 0x100022b15
mov eax, 3
jmp 0x100022b15
add rbx, 4
jmp 0x100022a40
movzx ecx, ax
call sub.msvcrt.dll_iswdigit
cmp eax, esi
jne 0x100022a48
add rbx, 2
movzx eax, word [rbx]
cmp ax, si
jne 0x100022a30
movzx ecx, word [rbx]
call sub.msvcrt.dll_iswdigit
cmp eax, esi
je 0x100022a98
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x7ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x83f], sil
call qword [sym.imp.msvcrt.dll__atoi64]
mov qword [rdi + 0x18], rax
mov eax, 1
jmp 0x100022b15
add rbx, 4
jmp 0x100022ab5
movzx ecx, ax
call sub.msvcrt.dll_iswdigit
cmp eax, esi
jne 0x100022abd
add rbx, 2
movzx eax, word [rbx]
cmp ax, si
jne 0x100022aa5
movzx ecx, word [rbx]
call sub.msvcrt.dll_iswdigit
cmp eax, esi
je 0x100022b0f
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x7ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x83f], sil
call qword [sym.imp.msvcrt.dll__atoi64]
mov qword [rdi + 0x18], rax
jmp 0x100022b13
mov qword [rdi + 0x18], rsi
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1000270a0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x10002564c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x170
mov rax, qword [0x10002a110]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, rdx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x10]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
lea rax, [rsi + 0xc]
mov qword [rsp + 0x28], rcx
lea rdx, [0x100015528]
xor r9d, r9d
mov rcx, r12
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
cmp dword [rsi + 0x1798], edi
jbe 0x100025865
lea rbx, [rsi + 0x570]
cmp dword [rbx], 0xffffffff
je 0x100025850
mov eax, dword [rbx]
lea r9d, [rdi + 1]
lea r8, [0x100015548]
mov rbp, qword [rsi + rax*8 + 0x2408]
lea rcx, [rsp + 0x90]
mov edx, 0x64
call fcn.100022480
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x20019
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100025850
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea rdx, [0x100015560]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x50]
lea rax, [rbp + 0x2ba4]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x58]
lea rdx, [0x100015578]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rsp + 0x68]
mov rcx, qword [rax]
cmp rcx, qword [rbp + 0x440]
jne 0x1000257dd
mov rcx, qword [rax + 8]
cmp rcx, qword [rbp + 0x448]
jne 0x1000257dd
xor eax, eax
jmp 0x1000257e2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002580f
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x100025806
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x100025806
xor eax, eax
jmp 0x10002580b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100025845
lea rcx, [rsp + 0x50]
lea rax, [rbp + 0x2ba8]
lea rdx, [0x100015590]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
add rbx, 0x240
cmp edi, dword [rsi + 0x1798]
jb 0x1000256df
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1000270a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x100025a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
lea r8, [0x1000130c0]
xor ecx, ecx
mov rbx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
and qword [rbx], 0
mov rdi, rax
test rax, rax
je 0x100025b28
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x100025b1e
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100025b1e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x100025b1e
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, rbp
mov dword [rsp + 0x28], 0x15
mov dword [rsp + 0x20], 0x400
call fcn.100025b48
test eax, eax
js 0x100025b2d
cmp qword [rbx], 0
je 0x100025b28
xor eax, eax
jmp 0x100025b2d
mov eax, 0x80004005
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1000272f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100027345
cmp rcx, 0xffffffffffffffff
je 0x100027345
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10002733d
cmp dword [rcx + 0x3c], edx
jl 0x10002733d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10002733d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100027345
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140190210
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14019021d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14019022d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140190215
lea eax, [rcx + 1]
jmp 0x14019023b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14019024e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140190234
sub eax, 3
jb 0x14019026e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401902bd
sar eax, 1
movsxd rbp, eax
jb 0x1401902a4
jmp 0x14019027c
add ebx, ebx
jne 0x14019027a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401902a4
inc ecx
add ebx, ebx
jne 0x14019028a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401902a4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14019029d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14019028c
add ecx, 2
jmp 0x1401902a9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401901d2
jmp 0x14019021d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x53400
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140190309
cmp rsi, rcx
jae 0x140190311
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401902f0
cmp al, 0x8f
ja 0x1401902f0
cmp byte [rsi - 2], 0xf
je 0x1401902f6
sub al, 0xe8
cmp al, 1
ja 0x1401902da
cmp rsi, rcx
jae 0x140190311
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401902e0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140190311
lodsb al, byte [rsi]
jmp 0x1401902f0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x18d000]
mov eax, dword [rdi]
or eax, eax
je 0x14019037a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1901e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14019031e
jns 0x140190353
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14019035d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140190374
mov qword [rbx], rax
add rbx, 8
jmp 0x14019033e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401903b4
cmp al, 0xef
ja 0x1401903a6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140190386
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140190395
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140190408
sub rsp, 0xffffffffffffff80
jmp 0x140053044
Function at 0x140002cd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d1e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d20
xor al, al
add rsp, 0x28
ret
Function at 0x140001470
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
lea rcx, [0x140005564]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Spoofing..._n_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002cb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov ecx, 0x20
call fcn.1400031f0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x1a
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem32dr.sys]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140005588]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140005590]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
mov r8d, 0x1d98
lea rdx, [0x1400090c0]
lea rcx, [rsp + 0x20]
call fcn.1400012b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000154d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001548
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000322c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov ecx, 0x20
call fcn.1400031f0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x1a
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.C:WindowsSystem32mp.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400055a8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x1400055b0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
mov r8d, 0x84800
lea rdx, [0x1403aa870]
lea rcx, [rsp + 0x20]
call fcn.1400012b0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001606
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001601
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001601
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000322c
lea rcx, str.C:WindowsSystem32mp.exe_C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32dr.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32mp.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov dh, 0x9d
invalid
Function at 0x140001980
Capabilities:
Create thread
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov dword [rsp + 0x34], edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
lea rax, str.Saturn_Free_Temp
mov qword [rsp + 0x50], rax
lea rax, str.Made_By_Payson
mov qword [rsp + 0x58], rax
lea rax, str.discord.gg_saturniv
mov qword [rsp + 0x60], rax
lea rax, str.t.me_saturncheats
mov qword [rsp + 0x68], rax
lea ecx, [rdi + 0x18]
call fcn.1400031f0
mov dword [rax], 4
lea rcx, [rsp + 0x50]
mov qword [rax + 8], rcx
lea rcx, [0x140001930]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140003130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140001af7
cmp dword [rsp + 0x48], edi
je 0x140001aeb
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140001aeb
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, str.color_5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_Saturn_Free_Temp_n_discord.gg_saturniv
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002cb0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140005564]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001640
nop
cmp dword [rsp + 0x48], edi
je 0x140001acb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400031d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140001ea0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001ec1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001eee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001ef0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001f49
test ecx, ecx
jle 0x140001f29
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001f49
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001f49
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
push rbx
pushfq
invalid
mov dh, 0xdd
mov edi, 0xd8e0968a
jns 0x14000c9e5
jge 0x14000c998
mov ebp, 0x351c8f9e
mov esi, 0xe341a081
mov cl, ch
jrcxz 0x14000c9c3
mov cl, ch
mov bl, byte [rax + 0x783a0f97]
movabs al, byte [0x6b8dbc65de6509fd]
fucom st(4)
pop rdi
or al, 0x4b
loope 0x14000c9cd
loope 0x14000c9cd
fiadd word [rbx]
invalid