joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800096d0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor ebx, ebx
call fcn.180005c04
test al, al
je 0x180009718
xor al, al
jmp 0x1800098d5
call fcn.1800095f0
test al, al
je 0x180009728
mov al, 1
jmp 0x1800098d5
mov rcx, rsi
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180009777
lea rcx, [rbp - 0x50]
call fcn.180005a50
nop
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1800121c0
test al, al
je 0x18000976e
lea rcx, [rbp - 0x50]
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x50]
call fcn.1800059ec
mov rcx, rsi
call fcn.1800095f0
test al, al
jne 0x180009721
mov rcx, rsi
call fcn.180005c10
mov r14, rax
test rax, rax
je 0x180009872
call fcn.180005a68
mov rdi, rax
mov r12d, 0x2f
lea r15d, [r12 + 0x2d]
nop word [rax + rax]
mov rcx, rdi
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1800097c0
mov rcx, qword [rdi]
cmp r12w, word [rcx + rbx*2]
je 0x1800097de
mov rax, rdi
cmp rdx, 8
jb 0x1800097d3
mov rax, qword [rdi]
cmp r15w, word [rax + rbx*2]
jne 0x180009866
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.180008910
nop
lea rcx, [rbp - 0x50]
call fcn.180005c04
test al, al
jne 0x18000985d
lea rcx, [rbp - 0x50]
call fcn.180009270
test al, al
jne 0x18000985d
lea rcx, [rbp - 0x50]
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18000985d
lea rcx, [rbp - 0x30]
call fcn.180005a50
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800121c0
test al, al
je 0x180009853
lea rcx, [rbp - 0x30]
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x30]
call fcn.1800059ec
nop
lea rcx, [rbp - 0x50]
call fcn.1800059ec
inc rbx
cmp rbx, r14
jb 0x1800097b0
mov rcx, rsi
call fcn.180009270
test al, al
jne 0x1800098cd
mov rcx, rsi
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800098cd
lea rcx, [rbp - 0x30]
call fcn.180005a50
nop
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.1800121c0
test al, al
je 0x1800098c4
lea rcx, [rbp - 0x30]
call fcn.1800059dc
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rbp - 0x30]
call fcn.1800059ec
mov rcx, rsi
call fcn.1800095f0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180016920
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180010aa0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
mov dword [rsp + 0x20], VarUI4FromDisp
mov qword [rcx + 8], rax
mov rbx, rcx
mov qword [rcx + 0x10], rax
xor edx, edx
mov qword [rcx + 0x18], rax
mov r8d, VarUI4FromDisp
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x50], rax
mov byte [rcx], al
lea rcx, [rsp + 0x24]
call fcn.180018f90
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x180010b20
cmp dword [rsp + 0x24], 6
jb 0x180010b20
mov byte [rbx], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180016920
add rsp, 0x150
pop rbx
ret

Function at 0x180010b40
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rcx
lea rdx, str.wintrust.dll
lea rcx, [rax - 0x50]
call fcn.180005e78
nop
call fcn.1800115f0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.180011690
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.1800059ec
lea rdx, str.crypt32.dll
lea rcx, [rsp + 0x48]
call fcn.180005e78
nop
call fcn.1800115f0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.180011690
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.1800059ec
test rbx, rbx
je 0x180010c96
test rdi, rdi
je 0x180010c96
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 8], rax
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x20], rax
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x28], rax
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x30], rax
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x38], rax
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x40], rax
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x48], rax
lea rdx, str.CertNameToStrW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x50], rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180013470
Capabilities:
Check mutex on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x1800134b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], r14
mov word [rsi + 8], r14w
mov qword [rsp + 0x48], r14
mov ecx, 0x58
call fcn.1800170f0
mov rdi, rax
mov qword [rsp + 0x48], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov dword [rax + 0x10], 0x18
lea rbx, [rax + 0x28]
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r14d
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x28]
call fcn.180005e78
nop
call fcn.1800115f0
mov rcx, rax
lea rdx, [rsp + 0x28]
call fcn.180011690
mov qword [rdi + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.1800059ec
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180012b70
mov rbx, qword [rsp + 0x48]
mov qword [rbx], rax
cmp qword [rbx], 0
lea r9, [rbx + 0x10]
jne 0x18001353e
mov r9, r14
mov rcx, rbp
call fcn.180005c04
test al, al
jne 0x180013551
call fcn.1800059dc
jmp 0x180013554
mov rax, r14
mov r8, rax
xor edx, edx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
test rax, rax
je 0x18001357b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18001357b
mov byte [rsi + 9], 1
cmp qword [rsi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800135a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800135b5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.180016944
mov qword [rsp + 0x48], r14
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180016920
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180028484
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x180028502
and dword [rsp + 0x2c], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
and dword [rsp + 0x28], 0
mov r9d, 2
and qword [rsp + 0x30], 0
mov rdx, 0xffffffff80000002
call fcn.180002620
mov rbx, qword [rsp + 0x20]
test eax, eax
jne 0x1800284f4
lea rdx, str.C4F75DB1_B9F4_425A_9F5B_778911BCF176
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test rbx, rbx
je 0x180028502
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180044478]
test rbx, rbx
je 0x180028538
jmp 0x180028532
call qword [rbx + 0x38]
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.1800049f8
test eax, eax
js 0x180028592
xor ecx, ecx
call qword [rbx + 8]
test eax, eax
js 0x180028592
add rbx, 0x48
cmp qword [rbx], 0
jne 0x180028510
mov rax, qword [0x180044400]
test rax, rax
je 0x18002854a
call rax
test eax, eax
js 0x180028592
mov rbx, qword [0x1800448e0]
xor eax, eax
mov rcx, qword [0x1800448e8]
jmp 0x18002858d
mov rdi, qword [rbx]
test rdi, rdi
je 0x180028589
call qword [rdi + 0x30]
mov rcx, qword [rdi]
xor r8d, r8d
mov rdx, rax
call fcn.1800049f8
test eax, eax
js 0x180028592
xor ecx, ecx
call qword [rdi + 8]
test eax, eax
js 0x180028592
mov rcx, qword [0x1800448e8]
add rbx, 8
cmp rbx, rcx
jb 0x18002855c
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180016920
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800285b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r14d, 1
test eax, eax
js 0x1800286ed
and dword [rbp - 0x14], 0
lea rdi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
and qword [rbp - 0x20], 0
lea r9d, [r14 + 1]
and dword [rbp - 0x18], 0
lea rcx, [rbp - 0x20]
and qword [rbp - 0x10], 0
mov rbx, 0xffffffff80000002
mov r8, rdi
mov rdx, rbx
call fcn.180002620
test eax, eax
je 0x180028699
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionShell_Extensions
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.180002568
test eax, eax
jne 0x18002864f
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18002864b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r8, rdi
lea rcx, [rbp - 0x20]
mov rdx, rbx
call fcn.180002568
test eax, eax
jne 0x18002867a
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x180028676
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x20], 0
and dword [rbp - 0x18], 0
mov r9d, 2
lea rcx, [rbp - 0x20]
mov r8, rdi
mov rdx, rbx
call fcn.180002620
test eax, eax
je 0x180028699
mov rcx, qword [rbp - 0x20]
jmp 0x1800286e2
lea rbx, str.2345_PC_Safe_Shell_Extension
mov rcx, rbx
call fcn.18001b8f4
mov r9d, r14d
lea rdx, str.C4F75DB1_B9F4_425A_9F5B_778911BCF176
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x1800286ed
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test rcx, rcx
je 0x1800286ed
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [0x180044478]
test rbx, rbx
je 0x180028728
jmp 0x180028722
mov ecx, r14d
call qword [rbx + 8]
test eax, eax
js 0x18002878a
call qword [rbx + 0x38]
mov rcx, qword [rbx]
mov r8d, r14d
mov rdx, rax
call fcn.1800049f8
test eax, eax
js 0x18002878a
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1800286fb
mov rbx, qword [0x1800448e0]
xor eax, eax
mov rdx, qword [0x1800448e8]
jmp 0x18002876c
mov rdi, qword [rbx]
test rdi, rdi
je 0x180028768
mov ecx, r14d
call qword [rdi + 8]
test eax, eax
js 0x18002878a
call qword [rdi + 0x30]
mov rcx, qword [rdi]
mov r8d, r14d
mov rdx, rax
call fcn.1800049f8
test eax, eax
js 0x18002878a
mov rdx, qword [0x1800448e8]
add rbx, 8
cmp rbx, rdx
jb 0x18002873a
test eax, eax
js 0x18002878a
mov rdx, qword [0x1800443f8]
test rdx, rdx
je 0x18002878a
mov rcx, qword [0x180043168]
call rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180016920
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180028f80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov ebx, 0x60
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rbx + 0x18]
call fcn.180018f90
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x76
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], 1
lea r8, str.LastLoadedDPI
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180029028
movzx eax, word [rsp + 0x40]
lea rdx, [rsp + 0x40]
xor ebx, ebx
jmp 0x180029022
cmp ax, 0x39
ja 0x180029028
movzx eax, ax
lea rbx, [rbx + rbx*4]
add rdx, 2
lea rbx, [rbx - 0x18]
lea rbx, [rax + rbx*2]
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x180029006
mov edx, 0x64
mov ecx, ebx
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov eax, 0x51eb851f
shl ecx, 4
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180016920
add rsp, 0xd0
pop rbx
ret
Function at 0x18002a25c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180042010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov dil, dl
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWARE2345PCSafe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002a2e5
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x18002a41a
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x70]
call fcn.180018f90
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x44], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x18002a346
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18002a2d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x40], 0x104
ja 0x18002a370
mov eax, dword [rsp + 0x40]
add rax, rax
cmp rax, 0x20a
jae 0x18002a445
mov word [rsp + rax + 0x70], si
jmp 0x18002a377
mov word [rbp + 0x178], si
movdqa xmm0, xmmword [0x1800381b0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180005c9c
lea rdx, [0x180037588]
lea rcx, [rsp + 0x48]
call fcn.180005fc4
lea rcx, [rsp + 0x48]
test dil, dil
lea rdx, str.2345MPCSafe.exe
jne 0x18002a3c2
lea rdx, str.2345ShellPro.exe
call fcn.180005fc4
lea rcx, [rsp + 0x48]
call fcn.180009430
mov qword [rbx + 0x10], rsi
test al, al
je 0x18002a405
mov qword [rbx + 0x18], rsi
mov r8d, 0x20
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.180018800
movdqa xmm0, xmmword [0x1800381b0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
jmp 0x18002a410
mov qword [rbx + 0x18], 7
mov word [rbx], si
lea rcx, [rsp + 0x48]
call fcn.1800059ec
mov rax, rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.180016920
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.180016a54
int3
Function at 0x140c5e898
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c5ea1f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c5e8c9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e8af
add dl, dl
jne 0x140c5e8d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e936
xor eax, eax
add dl, dl
jne 0x140c5e8e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e9ed
add dl, dl
jne 0x140c5e8f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e903
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e910
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e91d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c5e92a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c5e8be
mov eax, 1
add dl, dl
jne 0x140c5e946
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e953
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e93b
sub eax, ebx
mov ebx, 1
jne 0x140c5e98c
mov ecx, 1
add dl, dl
jne 0x140c5e96e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e97b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e963
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e8be
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c5e9a8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e9b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e99d
cmp eax, 0x7d00
jae 0x140c5e9db
cmp eax, 0x500
jb 0x140c5e9d6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e8be
cmp eax, 0x7f
ja 0x140c5e9de
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e8be
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c5ea12
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c5e8be
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180921058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1809211df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180921089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18092106f
add dl, dl
jne 0x180921096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809210f6
xor eax, eax
add dl, dl
jne 0x1809210a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809211ad
add dl, dl
jne 0x1809210b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809210c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809210d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809210dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1809210ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18092107e
mov eax, 1
add dl, dl
jne 0x180921106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180921113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809210fb
sub eax, ebx
mov ebx, 1
jne 0x18092114c
mov ecx, 1
add dl, dl
jne 0x18092112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18092113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180921123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18092107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180921168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180921175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18092115d
cmp eax, 0x7d00
jae 0x18092119b
cmp eax, 0x500
jb 0x180921196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18092107e
cmp eax, 0x7f
ja 0x18092119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18092107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1809211d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18092107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400036b0
Capabilities:
Get hostname
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x320]
sub rsp, 0x420
xorps xmm0, xmm0
xorps xmm1, xmm1
mov edi, ecx
lea rcx, str.ntdll.dll
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000376c
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000376c
xor edx, edx
lea rcx, [rbp + 4]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp]
mov dword [rbp], 0x114
call rbx
test eax, eax
jne 0x14000376c
mov r9d, dword [rbp + 0xc]
lea r8, [0x140155ba8]
lea edx, [rax + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140002ca0
jmp 0x140003782
lea r8, [0x140155bb0]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x60]
call fcn.140002ca0
lea rdx, [rbp + 0x338]
mov dword [rbp + 0x338], reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140157998]
mov edx, 0x100
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x60]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], edi
lea r8, [0x140155bc0]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x120]
call fcn.140002ca0
lea rax, [rbp + 0x120]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400037f5
xor edi, edi
lea rdx, [0x140155b70]
xor r9d, r9d
mov qword [rbp + 0x340], rdi
xor r8d, r8d
lea rcx, [rbp + 0x340]
add ebx, ebx
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x1400038b1
mov rcx, qword [rbp + 0x340]
lea rdx, [rbp + 0x338]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rbp + 0x338], rdi
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
jne 0x1400038a2
mov rcx, qword [rbp + 0x338]
lea rdx, [rbp + 0x120]
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
jne 0x140003895
mov rcx, qword [rbp + 0x338]
lea r8d, [rdi + 0x20]
xor r9d, r9d
lea rdx, [rsp + 0x40]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rcx, qword [rbp + 0x340]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov eax, dword [rsp + 0x40]
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003b30
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x260
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003b89
lea rdx, str.VALORANT_Win64_Shipping.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140003ba1
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003b61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1408f2fa0]
add rsp, 0x260
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x1408f2fa0], eax
add rsp, 0x260
pop rbx
ret