joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003210
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x180003244
mov ecx, esi
lea eax, [rcx + 0x13]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 7
jb 0x180003230
mov byte [r8 + 8], sil
lea rax, [r8 + 7]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
cmp r9, rax
je 0x180003279
mov r8d, 7
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.180012510
nop
cmp byte [rbx + 9], 0
je 0x1800032a3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 8
jb 0x180003290
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1800032d8
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180012510
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.180011f70
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18000332c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003326
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003326
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000336c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003367
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003367
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180003f00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x180003f34
mov ecx, esi
lea eax, [rcx + 0x13]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x180003f20
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
cmp r9, rax
je 0x180003f69
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.180012510
nop
cmp byte [rbx + 0xa], 0
je 0x180003f93
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x180003f80
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x180003fc8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180012510
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.180011f70
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18000401c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004016
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004016
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000405c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004057
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004057
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
cmp byte [rcx + 8], r8b
je 0x1800045c3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x1800045b0
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x1800045ec
mov r8d, 7
mov rcx, rbx
call fcn.180012510
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180012fc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r8, rcx
mov r9d, 0x811c9dc5
cmp byte [rcx], al
je 0x180013007
nop
inc eax
cmp byte [rax + rcx], 0
jne 0x180012fd0
test eax, eax
je 0x180013007
mov r10d, eax
nop
movzx ecx, byte [r8]
lea r8, [r8 + 1]
lea edx, [rcx - 0x41]
cmp dl, 0x19
lea eax, [rcx + 0x20]
cmovbe ecx, eax
movsx eax, cl
xor eax, r9d
imul r9d, eax, 0x1000193
sub r10, 1
jne 0x180012fe0
mov eax, r9d
ret
Function at 0x1800142b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 5], sil
je 0x1800142e4
mov ecx, esi
lea eax, [rcx + 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 4
jb 0x1800142d0
mov byte [r8 + 5], sil
lea rax, [r8 + 4]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp r9, rax
je 0x180014319
mov r8d, 4
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180012510
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180014327
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.180011690
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001439c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180014620
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rdi, rcx
xor esi, esi
mov dword [rbp + 0x47], esi
mov rdx, qword [rcx]
mov rax, qword [rdx]
mov qword [rdx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
mov edx, 0x3314
cmp ax, 4
jne 0x1800146e5
mov dword [rbp - 0x39], 0xa6f86267
mov dword [rbp - 0x35], 0x61885106
mov dword [rbp - 0x31], 0x3336
mov byte [rbp - 0x2d], 1
mov eax, esi
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 5
jb 0x180014690
mov byte [rbp - 0x2d], sil
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], si
mov r8d, 5
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.180011cf0
nop
mov ebx, reloc.WS2_32.dll_listen
lea rax, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rax, qword [rbp + 0x27]
jmp 0x18001478b
mov dword [rbp - 0x29], 0x33793357
mov dword [rbp - 0x25], 0x33643379
mov dword [rbp - 0x21], 0x337d337d
mov dword [rbp - 0x1d], 0x3368333a
mov dword [rbp - 0x19], 0x337e3369
mov dword [rbp - 0x15], 0x337a337d
mov dword [rbp - 0x11], 0x33523353
mov dword [rbp - 0xd], 0x33563344
mov dword [rbp - 9], 0x33493348
mov dword [rbp - 5], 0x3309335f
mov word [rbp - 1], si
mov byte [rbp + 1], 1
mov rcx, rsi
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x29], ax
inc rcx
cmp rcx, 0x14
jb 0x180014740
mov byte [rbp + 1], sil
mov qword [rbp + 7], rsi
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.180011cf0
mov ebx, 0x32
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rax, qword [rbp + 7]
mov rcx, qword [rdi + 8]
mov rdx, rax
mov rcx, qword [rcx]
call fcn.1800196f0
test bl, 2
je 0x1800147f5
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1800147e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800147e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800147e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
mov qword [rbp + 0x17], rsi
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], si
test bl, 1
je 0x18001483d
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x18001483d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c20c
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180014ca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180014cc8
xor eax, eax
lea r8, [0x180013010]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180014e30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
cmp byte [rcx + 7], r8b
je 0x180014e63
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x180014e50
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x180014e8c
mov r8d, 6
mov rcx, rbx
call fcn.180012510
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180014ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rdx, rcx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
cmp byte [rcx + 0xe], r8b
je 0x180014ed3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x13]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x180014ec0
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x180014efc
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.180012510
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x180015200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180015237
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180015258
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18001525a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800152b3
test ecx, ecx
jle 0x180015293
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800152b3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800152b3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800152e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180015302
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180015318
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180015334
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180015336
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x180015370
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180015417
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1800153ab
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1800153f1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180015430
cmp rbx, rax
ja 0x1800153c0
mov r8, rdi
test rdi, rdi
je 0x180015417
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x18001541a
Function at 0x180015830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18001585d
xor eax, eax
jmp 0x1800159b2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180015888
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180015888
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800159b2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800159a5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800158cb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800158f6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800159aa
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180015965
sub eax, 1
je 0x180015965
cmp eax, 2
jne 0x1800159a5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800159aa
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180015993
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800159a5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1800159aa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18007c1c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180015db0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180015e83
cmp byte [rcx + 0x71], 0
je 0x180015e83
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180015e7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180015e44
sub eax, 1
je 0x180015e48
cmp eax, 2
jne 0x180015e7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007c1c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180015e76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180015e7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180015e2c
xor al, al
jmp 0x180015e2c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007c1c0
add rsp, 0x60
pop rbx
ret

Function at 0x1800169a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Identify system language via api

Disassembly:
add rcx, 8
jmp fcn.180014620
Function at 0x180016a90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, qword [rcx + 0x10]
xor ebx, ebx
mov rbp, qword [rcx + 8]
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180016b47
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x180016af4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180016b47
mov qword [rsp + 0x2a8], r14
lea r14, str.League_of_Legends.exe
lea rdx, [rsp + 0x5c]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r14 + rax*2]
jne 0x180016b95
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r14 + rax*2 + 2]
jne 0x180016b95
add rax, 2
cmp rax, 0x16
jne 0x180016b10
mov ebx, dword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x2a8]
xor r8d, r8d
lea r9, [rsp + 0x20]
mov dl, 1
lea ecx, [r8 + 0x14]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edx, ebx
mov rcx, rbp
call fcn.18001ec30
mov r8, rax
mov edx, ebx
mov rcx, rsi
call fcn.18001f550
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18007c1c0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180016b03
jmp 0x180016b36

Function at 0x180019810
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
mov rbx, qword [rcx]
cmp rbx, rdi
je 0x18001983e
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18001984b
add rbx, 4
cmp rbx, rdi
jne 0x180019826
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x180019860
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
sete al
add rsp, 0x28
ret
Function at 0x18001b200
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.ProgramData
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x18001b283
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b271
lea rdx, [rsp + 0x30]
jmp 0x18001b2a1
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
xor r8d, r8d
lea rdx, [0x180094c18]
mov rcx, rbx
call fcn.180011cf0
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18007c1c0
add rsp, 0x250
pop rbx
ret
Function at 0x18001b850
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1800a3690]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rdx
mov r14, rcx
mov dword [rsp + 0x58], 0x208
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18001b8af
mov rdx, qword [rbx]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18001b8dd
xor al, al
jmp 0x18001ba7b
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b903
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.180011cf0
nop
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 8
cmovae rcx, rdi
mov r12d, 0xa
mov qword [rsp + 0x20], r12
lea r9, str.RUNASADMIN
mov rdx, qword [rsp + 0x48]
call fcn.18001d310
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18001b961
mov bl, 1
jmp 0x18001ba3a
call fcn.18001a640
mov qword [rsp + 0x30], 1
lea rcx, [rsp + 0x30]
call fcn.18001d020
mov r8, qword [rsp + 0x48]
cmp r8, r15
jb 0x18001baa6
mov rax, r8
sub rax, r15
cmp rax, r12
cmovb r12, rax
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
lea rcx, [rax + r15*2]
sub r8, r12
mov qword [rsp + 0x48], r8
lea rdx, [rcx + r12*2]
sub r8, r15
lea r8, [r8*2 + 2]
call sub.VCRUNTIME140.dll_memmove
cmp qword [rsp + 0x48], 0
jne 0x18001b9e7
cmp qword [rbx + 0x18], 8
jb 0x18001b9d7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
jmp 0x18001ba2b
mov eax, dword [rsp + 0x48]
lea ecx, [rax*2 + 2]
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
cmp qword [rbx + 0x18], 8
jb 0x18001ba0d
mov rbx, qword [rbx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
sete bl
cmp rsi, 8
jb 0x18001ba78
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001ba70
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ba70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18007c20c
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18007c1c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800119d0
nop
int3