joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a0ef0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r10d, 0xffffffff
lea r8, [0x18010be81]
mov ecx, r10d
lea rbx, [0x180105eb0]
movaps xmm4, xmm3
mov r11, rdx
mov r9b, 0x23
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1800a0f33
cmp byte [r8], r9b
jne 0x1800a0f33
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800a0f20
not ecx
call fcn.18000d9d0
mov rbx, qword [0x18013b3b0]
xor edi, edi
test rax, rax
je 0x1800a0f71
cmp word [rax + 0xd8], di
jne 0x1800a1010
test r11, r11
jne 0x1800a0f80
mov rax, qword [rbx + 0x4b28]
mov r11, qword [rax]
movss xmm1, dword [r11 + 0xb8]
movss xmm0, dword [r11 + 0x10]
movaps xmm3, xmm1
addss xmm3, dword [r11 + 8]
movss xmm2, dword [r11 + 0xbc]
subss xmm0, xmm1
addss xmm2, dword [r11 + 0xc]
xorps xmm1, xmm1
addss xmm0, dword [r11 + 0xc0]
or dword [rbx + 0x4a18], 3
mov qword [rbx + 0x4a30], rdi
mov dword [rbx + 0x4a1c], 1
mov dword [rbx + 0x4a20], 1
maxss xmm1, xmm0
movaps xmm0, xmm3
unpcklps xmm0, xmm2
movsd qword [rbx + 0x4a28], xmm0
addss xmm1, xmm3
subss xmm1, xmm3
unpcklps xmm1, xmm4
movsd qword [rbx + 0x4a38], xmm1
addss xmm4, dword [r11 + 0xbc]
movss dword [r11 + 0xbc], xmm4
movss xmm0, dword [rbx + 0x38f8]
lea rcx, [rbx + 0x4aa0]
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x24], xmm0
mov dword [rsp + 0x20], 3
call fcn.18002be90
mov dword [rbx + 0x38f8], edi
lea rdx, [rsp + 0x20]
mov rbx, qword [0x18013b3b0]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x3900]
lea rcx, [rbx + 0x4aa0]
movss xmm0, dword [rbx + 0x3904]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.18002be90
xor edx, edx
mov qword [rbx + 0x3900], rdi
mov r8d, 0x50f
lea rcx, str.MainMenuBar
call fcn.1800106e0
mov ecx, 2
movzx ebx, al
call fcn.180005d90
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800a3e40
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x1800a3ecc
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800a3ea0
lea r11, [0x180105eb0]
nop
cmp r9b, 0x23
jne 0x1800a3e83
cmp byte [r8], r9b
jne 0x1800a3e83
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800a3e70
mov rcx, qword [0x18013b3b0]
not eax
cmp dword [rcx + 0x4074], eax
jne 0x1800a3eb7
mov dword [rcx + 0x4078], eax
cmp dword [rcx + 0x40a4], eax
jne 0x1800a3f29
mov byte [rcx + 0x40a8], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18013b3b0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4010]
movsxd rax, dword [rbx + 0x108]
mov r8, qword [rbx + 0x110]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180003ab0
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x405c], eax
jne 0x1800a3f22
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18002a7a0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800ad6f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180136040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800ad73f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18013b3c8]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1800ad77d
cmp rsi, r14
jb 0x1800ad775
cmp rsi, r15
jae 0x1800ad775
cmp qword [rsi + 8], 0
jne 0x1800ad947
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800ad760
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800ad812
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800ad809
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800ad809
cmp dword [rsp + 0x40], 0x10000
je 0x1800ad88b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800ad809
sub rbx, rbp
cmp rbx, r14
jae 0x1800ad7d0
test rsi, rsi
jne 0x1800ad8f0
cmp rdi, r15
ja 0x1800ad92f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800ad92f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800ad92f
cmp dword [rsp + 0x40], 0x10000
je 0x1800ad8c1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800ad842
jmp 0x1800ad92f
test rbx, rbx
je 0x1800ad809
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800ad8f0
cmp rbx, r14
jae 0x1800ad7b0
jmp 0x1800ad812
test rdi, rdi
je 0x1800ad92f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800ad8f0
cmp rdi, r15
jbe 0x1800ad820
jmp 0x1800ad92f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800ad900
mov rax, qword [0x18013b3c8]
mov qword [rsi], rax
mov qword [0x18013b3c8], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800e43a0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x1800ae360
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180136040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800ae4af
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800ae4a6
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x1800ae45c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800ae45c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800ae45c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x1800ae41d
mov rcx, qword [0x18013b3d0]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x1800ae485
lea rbx, [rdi + 0xc]
jmp 0x1800ae451
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x1800ae451
mov rcx, qword [0x18013b3d0]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800ae485
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800ae3c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800ae4a1
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x1800ae4a1
mov rcx, qword [0x18013b3d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800e43a0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1800ae4d0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.1800ae360
test eax, eax
jne 0x1800ae517
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x1800ae58e
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x1800ae576
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800ae56a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800ae1b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x1800ae530
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800ae5b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180136040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18013b580]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800ae623
mov eax, 0xa
jmp 0x1800ae6b6
test esi, esi
je 0x1800ae645
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800ae668
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800ae668
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800ae661
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800ae668
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800e43a0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800ae6e0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x18013b58c]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x1800ae727
mov rax, qword [0x18013b580]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800ae734
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x1800ae710
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x1800ae727
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1800ae4d0
mov edi, eax
test eax, eax
jne 0x1800ae81d
mov r9d, dword [0x18013b58c]
cmp ebx, r9d
jae 0x1800ae7ac
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18013b580]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x1800ae7a5
mov edx, esi
mov ecx, ebx
call fcn.1800ae5b0
mov edi, eax
test eax, eax
jne 0x1800ae7ac
mov r9d, dword [0x18013b58c]
inc ebx
cmp ebx, r9d
jb 0x1800ae770
cmp qword [rsp + 0x20], 0
je 0x1800ae81b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800ae807
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800ae7f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800ae7d0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18013b3d0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x1800aeb20
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x18013b3d8], ebp
je 0x1800aeb77
cmp rbx, 0x20
jae 0x1800aeb60
xor ecx, ecx
jmp 0x1800aeb62
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18013b3d8], ebp
jne 0x1800aeb56
cmp qword [0x18013b3d0], r15
je 0x1800aec71
test rdi, rdi
jne 0x1800aeb97
mov ecx, esi
call fcn.1800ae6e0
mov edi, eax
jmp 0x1800aec76
mov ecx, dword [0x18013b58c]
mov ebx, r15d
test ecx, ecx
je 0x1800aebbf
mov rdx, qword [0x18013b580]
mov rax, rdx
nop
cmp rdi, qword [rax]
je 0x1800aebc9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800aebb0
mov edi, 4
jmp 0x1800aec76
cmp ebx, 0xffffffff
je 0x1800aebbf
mov eax, ebx
imul rcx, rax, 0x38
movzx eax, byte [rcx + rdx + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800aec68
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ae4d0
mov edi, eax
test eax, eax
jne 0x1800aec76
mov edx, esi
mov ecx, ebx
call fcn.1800ae5b0
mov edi, eax
cmp qword [rsp + 0x20], r15
je 0x1800aec76
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800aec52
mov rbx, qword [rsp + 0x20]
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800aec48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800aec20
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18013b3d0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800aec76
neg esi
sbb edi, edi
add edi, 6
jmp 0x1800aec76
mov edi, 2
xchg dword [0x18013b3d8], r15d
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
Function at 0x1800af0c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x1800af14a
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, [0x18011fcf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800af0fd
mov byte [0x18013be98], 1
mov eax, 4
jmp 0x1800af102
mov eax, 3
xor esi, esi
mov dword [0x18013b6d8], eax
mov qword [rsp + 0x28], rsi
lea r8, [0x1800af240]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800af135
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test edx, edx
jne 0x1800af135
test r8, r8
jne 0x1800af135
call fcn.1800c33f0
xor esi, esi
mov edi, 1
mov ebx, esi
xor eax, eax
lock cmpxchg dword [0x18013b3d8], edi
je 0x1800af191
nop dword [rax]
cmp rbx, 0x20
jae 0x1800af17a
xor ecx, ecx
jmp 0x1800af17c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18013b3d8], edi
jne 0x1800af170
cmp qword [0x18013b3d0], rsi
je 0x1800af211
xor ecx, ecx
call fcn.1800ae6e0
test eax, eax
jne 0x1800af211
mov rcx, qword [0x18013b3c8]
mov qword [0x18013b3c8], rsi
test rcx, rcx
je 0x1800af1d9
nop dword [rax + rax]
mov rbx, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
test rbx, rbx
jne 0x1800af1c0
mov r8, qword [0x18013b580]
xor edx, edx
mov rcx, qword [0x18013b3d0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18013b3d0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x18013b3d0], rsi
mov qword [0x18013b580], rsi
mov qword [0x18013b588], rsi
xchg dword [0x18013b3d8], esi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800b7890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov edi, edx
and edi, 7
je 0x1800b7924
cmp edx, edi
jge 0x1800b7915
mov r8d, dword [rcx + 0x18]
mov eax, 1
mov ecx, edx
mov r10d, edx
shl eax, cl
mov r9d, edx
cmp r8d, eax
jae 0x1800b790b
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x1800b78d3
xor cl, cl
jmp 0x1800b78dc
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r10 + 8]
mov ecx, r10d
mov dword [rbx + 0x10], edx
shl eax, cl
or r8d, eax
mov dword [rbx + 0x18], r8d
cmp edx, 0x18
jg 0x1800b7915
mov ecx, edx
mov eax, 1
shl eax, cl
mov r10d, edx
mov r9d, edx
cmp r8d, eax
jb 0x1800b78c7
mov rax, qword [rbx + 8]
mov edx, r9d
mov qword [rbx], rax
mov eax, dword [rbx + 0x18]
mov ecx, edi
shr eax, cl
sub edx, edi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x10], edx
xor r8d, r8d
mov eax, edx
test edx, edx
jle 0x1800b795e
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x1800b7940
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1800b7992
mov edx, dword [0x18013b348]
mov rax, qword gs:[0x58]
mov ecx, 0x148
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1800b79c1
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1800b79ab
xor dl, dl
jmp 0x1800b79b4
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800b79a2
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1800b7962
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1800b7a31
mov edx, dword [0x18013b348]
mov rax, qword gs:[0x58]
mov ecx, 0x148
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x1800b7a4f
mov rcx, rbx
call fcn.1800b6c60
test eax, eax
je 0x1800b7985
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800e4040
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
lea r8, [0x1800e4020]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800e40a6
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x1800e5678
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1800e56f0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1800e56f0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1800e56f0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1800e56e4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1800e5702
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1800e56d2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1800e56f2
Function at 0x1400031c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov rsi, rdx
movsxd rdx, dword [0x1400e9fd4]
mov rdi, rcx
movaps xmmword [rax - 0x38], xmm7
lea rcx, [0x1400e9ff0]
movaps xmmword [rax - 0x48], xmm8
mov rbx, r9
shl rdx, 5
mov rbp, r8
add rdx, qword [0x1400e9fd8]
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
call fcn.140003cd0
mov r9d, 0xc
lea r8, [rsp + 0x30]
xorps xmm9, xmm9
mov ecx, dword [rax]
shl ecx, 5
movsxd rdx, ecx
mov rcx, qword [0x1400e9e28]
add rdx, rbx
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm8, dword [rsp + 0x30]
movss xmm7, dword [rsp + 0x34]
subss xmm8, dword [rdi + 0x20]
subss xmm7, dword [rdi + 0x24]
movss xmm6, dword [rsp + 0x38]
subss xmm6, dword [rdi + 0x28]
movaps xmm0, xmm8
movaps xmm1, xmm7
xorps xmm6, xmmword [0x1400d41a0]
call fcn.14009763c
movaps xmm1, xmm0
movaps xmm0, xmm6
call fcn.14009798c
movaps xmm10, xmm0
movaps xmm1, xmm8
mulss xmm10, dword [0x1400d3ca0]
movaps xmm0, xmm7
subss xmm10, dword [rdi + 0x38]
call fcn.14009798c
movaps xmm8, xmm0
xorps xmm6, xmm6
mulss xmm8, dword [0x1400d3ca0]
movaps xmm0, xmm10
xorps xmm7, xmm7
subss xmm8, dword [rdi + 0x3c]
movaps xmm1, xmm8
call fcn.14009763c
movss xmm1, dword [0x1400e9fc8]
comiss xmm1, xmm0
jbe 0x1400032ec
movaps xmm6, xmm10
movaps xmm7, xmm8
movss xmm2, dword [0x1400d3cac]
comiss xmm6, xmm2
movss xmm1, dword [0x1400d3cd0]
movss xmm0, dword [0x1400d3cc0]
jbe 0x14000330e
comiss xmm0, xmm6
jae 0x140003324
comiss xmm6, xmm0
jbe 0x140003317
subss xmm6, xmm1
movss xmm2, dword [0x1400d3d40]
comiss xmm2, xmm6
jbe 0x140003327
movaps xmm6, xmm2
comiss xmm7, xmm0
jbe 0x140003330
subss xmm7, xmm1
movss xmm0, dword [0x1400d3d48]
comiss xmm0, xmm7
jbe 0x140003341
addss xmm7, xmm1
divss xmm6, dword [0x1400e9fc4]
divss xmm7, dword [0x1400e9fc4]
ucomiss xmm6, xmm9
jp 0x140003372
jne 0x140003372
ucomiss xmm7, xmm9
jp 0x140003372
jne 0x140003372
ucomiss xmm9, xmm9
jp 0x140003372
jne 0x140003372
mov qword [0x1400e9e10], rbx
jmp 0x1400033e7
cmp byte [0x1400ea000], bl
je 0x1400033a5
movsxd rdx, dword [0x1400ea004]
lea rcx, [0x1400ea038]
shl rdx, 5
add rdx, qword [0x1400ea020]
call fcn.140003cd0
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400033e7
addss xmm6, dword [rsi]
addss xmm7, dword [rsi + 4]
movss xmm1, dword [rsi + 8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x1400e9e28]
addss xmm1, xmm9
mov r9d, 0xc
mov qword [rsp + 0x20], rbx
mov rdx, rbp
unpcklps xmm6, xmm7
movsd qword [rsp + 0x30], xmm6
movss dword [rsp + 0x38], xmm1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
pop rsi
pop rbp
ret