joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016a314
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1401521f0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14016a39e
cmp byte [rbp - 0x21], r15b
je 0x14016a399
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14016a3d4
call fcn.14015b5c0
test eax, eax
jne 0x14016a3c0
cmp byte [rbp - 0x21], r15b
je 0x14016a3b8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14016a3d4
cmp byte [rbp - 0x21], r15b
je 0x14016a3d1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140152b94
test eax, eax
jne 0x14016a474
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1401521f0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14016a413
cmp byte [rbp - 0x21], r15b
je 0x14016a448
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14016a448
call fcn.14015b5c0
test eax, eax
jne 0x14016a434
cmp byte [rbp - 0x21], r15b
je 0x14016a42d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14016a448
cmp byte [rbp - 0x21], r15b
je 0x14016a445
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140152b94
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14016a474
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14016a477
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14016a485
mov rcx, rdi
call fcn.140159b88
cmp byte [rbp + 0x3f], r15b
je 0x14016a494
mov rcx, qword [rbp + 0x27]
call fcn.140159b88
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14016b1bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14015e840
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14015e840
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14016b30c
cmp rax, 0xffffffffffffffff
je 0x14016b30c
xor edi, edi
test rbp, rbp
jle 0x14016b2b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14015b228
mov rbx, rax
test rax, rax
jne 0x14016b244
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14016b2ad
mov edx, 0x8000
mov ecx, r14d
call fcn.1401579e0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14015cf90
cmp eax, 0xffffffff
je 0x14016b28d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14016b254
mov edx, r15d
mov ecx, r14d
call fcn.1401579e0
jmp 0x14016b2ad
cmp byte [rsi + 0x38], dil
je 0x14016b2a4
cmp dword [rsi + 0x34], 5
jne 0x14016b2a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14016b2ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140159b88
jmp 0x14016b320
jns 0x14016b320
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14015e840
cmp rax, 0xffffffffffffffff
jne 0x14016b2d8
cmp byte [rsi + 0x30], dil
je 0x14016b320
mov edi, dword [rsi + 0x2c]
jmp 0x14016b320
mov ecx, r14d
call fcn.140163f9c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14016b320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14016b320
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14016b319
mov eax, dword [rsi + 0x2c]
jmp 0x14016b31e
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14015e840
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14002d270
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14003d620]
lea rdx, [rsp + 0x20]
lea rcx, [0x14002d2c0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14002d2b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14002d2b2
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x14002d2b4
xor eax, eax
add rsp, 0x38
ret

Function at 0x14002d410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
xor edi, edi
lea r8, [0x14002d320]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], 0x50
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
lea rbx, str.MirakaKindaCuteNgl
mov edx, 0x7f00
mov qword [rsp + 0xa8], rax
xor ecx, ecx
movdqa xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rbx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rsp + 0x98]
mov r9d, 0x80000000
mov qword [rsp + 0x58], rdi
mov r8, rbx
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea edx, [rdi - 0x14]
mov r8d, 0x800a0
mov rcx, rax
mov qword [0x14003d6a0], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x14003d6a0]
lea r9d, [rdi + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x1400375a0]
lea rdx, [rsp + 0x70]
mov rcx, qword [0x14003d6a0]
movdqu xmmword [rsp + 0x70], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x14003d6a0]
lea edx, [rdi + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14003d6a0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x14002f550
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002f696
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14002f5a0
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x14002f5bb
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x14002f5f4
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14002f5ff
add rdx, 2
sub r8, 1
jne 0x14002f5e0
cmp r10, rcx
jb 0x14002f5ff
jbe 0x14002f6f7
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14002f68d
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14002f620
cmp qword [rbx + 0x18], 8
mov r9, rbx
mov r10, qword [rbx + 0x10]
jb 0x14002f63b
mov r9, qword [rbx]
cmp rcx, r10
lea rdx, [rsp + 0x4c]
mov r8, r10
cmovb r8, rcx
test r8, r8
je 0x14002f674
lea rax, [rsp + 0x4c]
sub r9, rax
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14002f67b
add rdx, 2
sub r8, 1
jne 0x14002f660
cmp r10, rcx
jb 0x14002f67b
jbe 0x14002f6f7
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14002f611
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14002f6d5
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002f6d0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002f763
mov rcx, r8
call fcn.140030738
xor eax, eax
mov word [rbx], ax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov edi, dword [rsp + 0x28]
cmp rdx, 8
jb 0x14002f73f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002f73a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002f763
mov rcx, r8
call fcn.140030738
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov eax, edi
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002f770
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
cmp qword [0x14003d730], 0
jne 0x14002f7d0
nop
lea rcx, str.Waiting_for_Valorant..._r
call fcn.1400011e0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.140030000
mov rcx, rax
call fcn.14002f550
mov dword [0x14003d620], eax
call fcn.14002d270
mov qword [0x14003d730], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14003d730], 0
je 0x14002f780
call fcn.14002c770
call fcn.14002d410
call fcn.14002cf20
lea rcx, [rsp + 0x20]
call fcn.1400301f0
nop
mov rcx, rax
call fcn.14002c730
nop
lea rcx, [rsp + 0x20]
call fcn.14002c710
call fcn.14002fba0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400301f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.140030a00
lea rcx, [0x14002e7e0]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140030640]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140030256
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140031004
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003104e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003104e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003104e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003104e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003104e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140031050
xor al, al
add rsp, 0x28
ret
Function at 0x6295f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6295fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x62960d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6295f5
lea eax, [rcx + 1]
jmp 0x62961b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x62962e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x629614
sub eax, 3
jb 0x62964e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x62969d
sar eax, 1
movsxd rbp, eax
jb 0x629684
jmp 0x62965c
add ebx, ebx
jne 0x62965a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x629684
inc ecx
add ebx, ebx
jne 0x62966a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x629684
call r11
adc ecx, ecx
add ebx, ebx
jne 0x62967d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x62966c
add ecx, 2
jmp 0x629689
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.006295b2
jmp 0x6295fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd5400
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x6296e9
cmp rsi, rcx
jae 0x6296f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x6296d0
cmp al, 0x8f
ja 0x6296d0
cmp byte [rsi - 2], 0xf
je 0x6296d6
sub al, 0xe8
cmp al, 1
ja 0x6296ba
cmp rsi, rcx
jae 0x6296f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x6296c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x6296f1
lodsb al, byte [rsi]
jmp 0x6296d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x225000]
mov eax, dword [rdi]
or eax, eax
je 0x62974e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x229000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x6296fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x629748
mov qword [rbx], rax
add rbx, 8
jmp 0x62971e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x629788
cmp al, 0xef
ja 0x62977a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x62975a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x629769
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x6297dc
sub rsp, 0xffffffffffffff80
jmp 0x4633c0
Function at 0x402ad0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x402aef
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x402d40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.004110c0]
mov r8d, 0x3f
mov edx, 1
lea rcx, str._GC__cannot_register_global_variable__too_many_global_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x402d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.004110c0]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
Function at 0x407a50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [rcx + 8], 0
mov rdi, qword [rcx]
mov rbp, rcx
mov rbx, rdx
mov rsi, rcx
js 0x407bb3
cmp rdi, 7
mov r8d, 7
mov rax, qword [0x00428628]
cmovl rdi, r8
cmp qword [0x00428620], rax
jle 0x407c11
mov rax, qword [0x00428618]
cmp qword [0x0042a710], rax
jge 0x407c11
lea rdx, [rdi + 0x21]
lea rcx, [0x00428678]
call fcn.00403af0
lea rsi, [0x00412020]
mov qword [rax + 8], rsi
mov qword [rax], 4
mov rdx, qword [0x00428628]
mov rcx, qword [0x00428638]
cmp rdx, 8
jle 0x407c29
shl rdx, 3
lea r9, [rcx + rdx - 8]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x10]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x18]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x20]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x28]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x30]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea r9, [rcx + rdx - 0x38]
mov r10, qword [r9]
mov r8, qword [r10]
cmp r8, 7
ja 0x407b80
lea rcx, [rcx + rdx - 0x40]
mov r8, qword [rcx]
mov rdx, qword [r8]
cmp rdx, 7
jbe 0x407c3a
and rdx, 0xfffffffffffffffb
mov qword [r8], rdx
mov qword [rcx], rax
jmp 0x407b8a
and r8, 0xfffffffffffffffb
mov qword [r10], r8
mov qword [r9], rax
lea rsi, [rax + 0x10]
mov qword [rsi + 8], rdi
mov qword [rax + 0x10], 0
mov rdi, qword [rbp]
lea rcx, [rax + 0x20]
lea rdx, [rbp + 0x10]
mov qword [rax + 0x10], rdi
lea r8, [rdi + 1]
call sub.msvcrt.dll_memcpy
lea r8, [rdi + rbx]
mov rcx, rsi
sub rcx, rbx
test rdi, rdi
jle 0x407c05
nop dword [rax]
nop word cs:[rax + rax]
mov rax, rbx
mov rdx, rbx
sar rax, 8
sar rdx, 0x10
xor eax, ebx
and edx, 0xffffffee
and eax, 0xffffffee
xor al, byte [rcx + rbx + 0x10]
xor eax, edx
mov rdx, rbx
sar rdx, 0x18
and edx, 0xffffffee
xor eax, edx
mov byte [rcx + rbx + 0x10], al
add rbx, 1
cmp rbx, r8
jne 0x407bd0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp qword [0x00428670], 0
jne 0x407aa5
call fcn.004067d0
jmp 0x407aa5
mov qword [rcx + rdx*8], rax
add qword [0x00428628], 1
jmp 0x407b8a
lea rcx, [0x00428628]
mov rdx, rax
mov qword [rsp + 0x28], rax
call fcn.004050d0
mov rax, qword [rsp + 0x28]
jmp 0x407b8a
Function at 0x408820
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbx, [0x00415b80]
mov r14, rcx
mov ebp, edx
mov edx, 0x42ceb224
lea rcx, [0x00415980]
call fcn.00407a50
lea rsi, [r14 + 2]
mov edx, 0x37d99bec
mov rcx, rax
call fcn.004085b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea rdi, [rax + 0x20]
nop dword [rax]
nop word cs:[rax + rax]
movzx eax, word [r14]
mov rdx, r14
test ax, ax
je 0x4088b0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x408a30
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x408890
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
je 0x408a52
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [r12 - 0x41]
cmp dx, 0x19
ja 0x408a60
add r12d, 0x20
add rax, 2
mov word [rax - 2], r12w
movzx r12d, word [rax]
test r12w, r12w
jne 0x4088d0
movzx r15d, word [r14]
movzx r12d, word [rcx]
test r15w, r15w
je 0x408965
test r12w, r12w
je 0x408a80
mov r10, rsi
mov eax, r15d
sub r10, rcx
jmp 0x408926
cmp word [rcx], 0
je 0x408965
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x408a80
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x408920
mov edx, 0x646452a4
mov rcx, rbx
call fcn.00407a50
mov edx, 0x4455ad6c
mov rcx, rax
call fcn.004085b0
cmp r15w, r12w
je 0x408a9f
mov r13, qword [r13]
cmp rdi, r13
jne 0x408880
test ebp, ebp
je 0x408ab4
lea rcx, [0x00415b00]
mov edx, 0x79d00d44
call fcn.00407a50
lea rbx, [rsp + 0x30]
mov edx, 0x3ea1994c
mov rcx, rax
call fcn.004085b0
mov rcx, rbx
mov rdx, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x0041a9e8]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x0041a9e0]
mov edx, 0x684e20c
lea rcx, [0x00415ac0]
mov ebx, eax
call fcn.00407a50
mov edx, 0x646452a4
mov rcx, rax
call fcn.004085b0
test ebx, ebx
jne 0x408ad2
mov rax, qword [rsp + 0x28]
jmp 0x408aa3
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x408890
mov rcx, qword [r13 + 0x50]
movzx r12d, word [rcx]
test r12w, r12w
jne 0x4088c2
movzx r15d, word [r14]
jmp 0x408965
add rax, 2
movzx r12d, word [rax]
test r12w, r12w
jne 0x4088d0
jmp 0x4088f6
mov rcx, rbx
mov edx, 0x646452a4
call fcn.00407a50
mov edx, 0x4455ad6c
mov rcx, rax
call fcn.004085b0
jmp 0x408989
mov rax, qword [r13 + 0x20]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x00415a80]
mov edx, 0x2dee182c
call fcn.00407a50
mov edx, 0x7ee00104
mov rcx, rax
call fcn.004085b0
xor eax, eax
jmp 0x408aa3
Function at 0x408ae0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rsi, [0x00415b80]
mov edx, 0x42ceb224
mov r13, rcx
lea rcx, [0x00415980]
call fcn.00407a50
lea rdi, [r13 + 2]
mov edx, 0x37d99bec
mov rcx, rax
call fcn.004085b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea rbp, [rax + 0x20]
nop
movzx eax, word [r13]
mov rdx, r13
test ax, ax
je 0x408b60
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x408ce0
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x408b40
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
je 0x408d01
mov rax, rcx
nop
nop word cs:[rax + rax]
lea edx, [rbx - 0x41]
cmp dx, 0x19
ja 0x408d10
add ebx, 0x20
add rax, 2
mov word [rax - 2], bx
movzx ebx, word [rax]
test bx, bx
jne 0x408b80
movzx r14d, word [r13]
movzx ebx, word [rcx]
test r14w, r14w
je 0x408c15
test bx, bx
je 0x408d30
mov r10, rdi
mov eax, r14d
sub r10, rcx
jmp 0x408bd6
cmp word [rcx], 0
je 0x408c15
movzx edx, word [rcx]
lea r9d, [rax - 0x41]
lea r8d, [rax + 0x20]
cmp r9w, 0x1a
cmovb eax, r8d
lea r9d, [rdx - 0x41]
lea r8d, [rdx + 0x20]
cmp r9w, 0x1a
cmovb edx, r8d
cmp ax, dx
jne 0x408d30
mov rax, rcx
add rcx, 2
movzx eax, word [r10 + rax]
test ax, ax
jne 0x408bd0
mov edx, 0x646452a4
mov rcx, rsi
call fcn.00407a50
mov edx, 0x4455ad6c
mov rcx, rax
call fcn.004085b0
cmp r14w, bx
je 0x408d4f
mov r12, qword [r12]
cmp rbp, r12
jne 0x408b30
lea rcx, [0x00415b00]
mov edx, 0x79d00d44
call fcn.00407a50
lea rbx, [rsp + 0x30]
mov edx, 0x3ea1994c
mov rcx, rax
call fcn.004085b0
mov rcx, rbx
mov rdx, r13
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
call qword [0x0041a9e8]
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x28]
call qword [0x0041a9e0]
mov edx, 0x684e20c
lea rcx, [0x00415ac0]
mov ebx, eax
call fcn.00407a50
mov edx, 0x646452a4
mov rcx, rax
call fcn.004085b0
xor eax, eax
test ebx, ebx
jne 0x408d54
mov rax, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rdx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x408b40
mov rcx, qword [r12 + 0x50]
movzx ebx, word [rcx]
test bx, bx
jne 0x408b71
movzx r14d, word [r13]
jmp 0x408c15
add rax, 2
movzx ebx, word [rax]
test bx, bx
jne 0x408b80
jmp 0x408ba0
mov rcx, rsi
mov edx, 0x646452a4
call fcn.00407a50
mov edx, 0x4455ad6c
mov rcx, rax
call fcn.004085b0
jmp 0x408c39
mov rax, qword [r12 + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret