joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800145d0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18004fe90]
cmp byte [rbx + 0x2f78], 0
je 0x1800146bc
cmp qword [rbx + 0x2f80], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f88]
je 0x1800146a4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x18001464b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180015cd0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.180004f20
mov eax, dword [rdi]
lea rcx, [0x18004fe81]
mov r9, qword [rbx + 0x2f80]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x2f90]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180004f20
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x180014a40
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18004fe90]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x180014a7e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x180014a75
test r13, r13
je 0x180014a8a
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x180014c50
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x180014c94
cmp al, 0xd
je 0x180014c94
mov rbx, rcx
cmp rcx, r12
jae 0x180014b03
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x180014b03
cmp al, 0xd
je 0x180014b03
inc rbx
cmp rbx, r12
jb 0x180014af0
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x180014c34
cmp al, 0x5b
jne 0x180014c1b
cmp rbx, rcx
jbe 0x180014c1b
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x180014c1b
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x180014c34
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x180014c34
mov r10, qword [0x18004fe90]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x180014bca
cmp r9b, 0x23
jne 0x180014ba7
cmp byte [r8], r9b
jne 0x180014ba7
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x180042bc0]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x180014b95
mov r8d, dword [r10 + 0x2f58]
xor eax, eax
not ecx
test r8d, r8d
jle 0x180014bf4
mov r9, qword [r10 + 0x2f60]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x180014bfa
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x180014be5
xor edi, edi
xor ebp, ebp
jmp 0x180014c34
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x180014bf6
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call qword [rdi + 0x10]
mov rbp, rax
jmp 0x180014c34
test rdi, rdi
je 0x180014c34
test rbp, rbp
je 0x180014c34
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x180014ad0
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x180014c7b
mov rax, qword [0x18004fe90]
test rax, rax
je 0x180014c7b
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2f40], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x180014ad0
Function at 0x180014ca0
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x18004fe90]
xor r15d, r15d
mov r14, rcx
mov dword [rbx + 0x2f44], r15d
test rcx, rcx
je 0x180014dcb
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 0x2f48]
mov dword [rbx + 0x2f44], r15d
mov ecx, dword [rdi + 4]
test ecx, ecx
jns 0x180014d04
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.180015cd0
mov dword [rdi], r15d
cmp dword [rdi + 4], r15d
jne 0x180014d1a
mov edx, 8
mov rcx, rdi
call fcn.180015cd0
movsxd rcx, dword [rdi]
mov ebp, r15d
mov rax, qword [rdi + 8]
mov byte [rcx + rax], r15b
inc dword [rdi]
cmp dword [rbx + 0x2f58], r15d
jle 0x180014d65
mov rsi, r15
nop word [rax + rax]
mov r9, qword [rbx + 0x2f60]
mov r8, rdi
add r9, rsi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rbx + 0x2f58]
jl 0x180014d40
mov eax, dword [rdi]
lea rdx, [0x180046edc]
test eax, eax
lea rdi, [0x18004fe81]
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f50]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.1800046f0
mov rbp, qword [rsp + 0x40]
mov rbx, rax
test rax, rax
je 0x180014dc1
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x18001fd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18001ff11
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18001fdf0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18001f740
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.18001eda0
mov dword [rbx + 0x80], 0
jmp 0x18001fefd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18001dcf0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180031a70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test dword [rcx + 0x58], 0x100000
mov r10, rdx
je 0x180031afb
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180031ad0
lea r10, [0x180042bc0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180031ab3
cmp byte [r8], r9b
jne 0x180031ab3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x180031aa0
mov rcx, qword [0x18004fe90]
not eax
cmp dword [rcx + 0x1aa8], eax
jne 0x180031ae7
mov dword [rcx + 0x1aac], eax
cmp dword [rcx + 0x1ae8], eax
jne 0x180031b4d
mov byte [rcx + 0x1aec], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x18004fe90]
mov rcx, r10
mov r8, qword [rbx + 0x1a60]
movsxd rax, dword [r8 + 0xc0]
mov r8, qword [r8 + 0xc8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180004640
cmp dword [rbx + 0x1aa8], eax
jne 0x180031b39
mov dword [rbx + 0x1aac], eax
cmp dword [rbx + 0x1ae8], eax
jne 0x180031b48
mov byte [rbx + 0x1aec], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180038760
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x18004fe98]
mov rbx, rcx
test rax, rax
jne 0x1800387c1
lea rcx, str.GameAssembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.il2cpp_string_new
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18004fe98], rax
test rax, rax
jne 0x1800387c1
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.error
lea rdx, str.error
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp rax

Function at 0x180038900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x180038a91
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x180038a91
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x18003899b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180038ab8
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x1800389b2
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x1800389b2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1800389c5
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x180038a12
mov r9d, eax
cmp eax, 0x800
jae 0x1800389df
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x180038a12
cmp eax, 0x10000
jae 0x1800389f9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x180038a12
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x180038a91
add qword [r14], 2
test sil, sil
jne 0x180038a33
cmp r10d, 3
jae 0x180038a3f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x180038a6e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x180038a50
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18003894f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x180038a9f
Function at 0x18003c110
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18003c330
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18003c217
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18003c174
mov rax, qword [0x18004f008]
cmp qword [rsp + 0x20], rax
ja 0x18003c174
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003c136
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003c1a3
jmp 0x18003c217
cmp dword [rsp + 0x50], 0x10000
jne 0x18003c1fa
cmp qword [rsp + 0x48], 0x10000
jb 0x18003c1fa
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003c1e8
mov rax, qword [rsp + 0x28]
jmp 0x18003c219
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003c212
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18003c330
mov qword [rsp + 0x20], rax
jmp 0x18003c136
xor eax, eax
add rsp, 0x68
ret

Function at 0x18003c220
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18003c370
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18003c323
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18003c27b
mov rax, qword [0x18004f008]
cmp qword [rsp + 0x20], rax
ja 0x18003c27b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18003c23d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18003c2aa
jmp 0x18003c323
cmp dword [rsp + 0x50], 0x10000
jne 0x18003c301
cmp qword [rsp + 0x48], 0x10000
jb 0x18003c301
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18003c2ef
mov rax, qword [rsp + 0x28]
jmp 0x18003c325
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18003c31e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18003c370
mov qword [rsp + 0x20], rax
jmp 0x18003c23d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18003c3c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18003c950
mov qword [rsp + 0x28], 0
cmp qword [0x18004f768], 0
jne 0x18003c408
cmp qword [0x18004f760], 0
je 0x18003c408
mov rax, qword [0x18004f760]
mov qword [0x18004f768], rax
cmp qword [0x18004f768], 0
je 0x18003c4ae
mov rax, qword [0x18004f768]
cmp qword [rax + 0x10], 0
je 0x18003c4ae
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18003c4ae
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18003c4ae
mov rax, qword [0x18004f768]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18003c474
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18003c47b
xor eax, eax
jmp 0x18003c629
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18003c629
mov rax, qword [0x18004f760]
mov qword [0x18004f768], rax
jmp 0x18003c4d0
mov rax, qword [0x18004f768]
mov rax, qword [rax + 8]
mov qword [0x18004f768], rax
cmp qword [0x18004f768], 0
je 0x18003c51d
cmp qword [0x18004f768], 0
je 0x18003c51b
mov rax, qword [0x18004f768]
cmp qword [rax + 0x10], 0
je 0x18003c51b
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18003c51b
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18003c51b
jmp 0x18003c44c
jmp 0x18003c4be
mov rcx, qword [rsp + 0x60]
call fcn.18003e580
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18003c630
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18003c627
mov rax, qword [rsp + 0x48]
mov qword [0x18004f768], rax
mov rax, qword [0x18004f768]
mov dword [rax], 0x52727464
mov rax, qword [0x18004f768]
mov qword [rax + 0x10], 0
mov rax, qword [0x18004f768]
mov rcx, qword [0x18004f760]
mov qword [rax + 8], rcx
mov rax, qword [0x18004f768]
mov qword [0x18004f760], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18004f768]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18003c5d8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18003c612
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18003c5ce
mov rax, qword [0x18004f768]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18003c44c
xor eax, eax
add rsp, 0x58
ret
Function at 0x140008e90
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get ntdll base address
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400cb83d]
jmp 0x140367297

Function at 0x140009d80
Capabilities:
Access peb ldr_data
Check for software breakpoints
Encrypt data using speck
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400cb8af]
jmp 0x140368ddd

Function at 0x1400e9fe4
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
xchg dh, dl
lea edx, [r8 + 2]
jmp 0x1401c6f69
jmp 0x1404651c8
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
xadd bh, bh
cmp rbp, rcx
mov dword [rsp + 0x10], edx
adc rbx, r8
rol ebx, 0xb9
cmc
push rbp
stc
mov rbp, rsp
add bh, 0x76
movzx bx, dh
sub rsp, 0x50
bt bx, 0x6b
not bh
mov ebx, ecx
cmc
test r8d, r8d
jmp 0x140465205
jne 0x14046529e
sub ecx, ecx
jmp 0x140465212
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14046529e
mov ecx, 0x5a4d
clc
cmp al, sil
cmp word [rax], cx
jmp 0x140465232
jne 0x14046529e
movsxd rcx, dword [rax + 0x3c]
test rcx, 0x7b30f2c
clc
lea rcx, [rcx + rax]
test dh, 0x73
cmc
test r11b, spl
cmp dword [rcx], 0x4550
jmp 0x14046525a
jne 0x14046529e
mov eax, 0x20b
test dl, r8b
stc
cmp word [rcx + 0x18], ax
jmp 0x140465272
jne 0x14046529e
cmp dword [rcx + 0x84], 0xe
jbe 0x14046529e
cmp dword [rcx + 0xf8], 0
jmp 0x140465291
je 0x14046529e
mov ecx, ebx
call fcn.14046507a
lea rax, [rbp + 0x18]
setg r8b
movzx r8w, r11b
not rdx
mov byte [rbp + 0x28], 0
movzx r8d, r12w
movsx dx, sil
cqo
mov qword [rbp - 0x20], rax
xchg r9, rax
lea r9, [rbp - 0x2c]
movzx r8d, r12w
not rcx
lea rax, [rbp + 0x20]
movzx ecx, si
mov qword [rbp - 0x18], rax
setnp al
lea r8, [rbp - 0x20]
cwde
xchg dx, cx
movsxd rdx, esp
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
xchg rdx, rdx
rdtsc
lea rdx, [rbp - 0x28]
movsxd rax, ebx
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x140465309
mov dword [rbp - 0x2c], eax
jmp 0x140465311
mov dword [rbp - 0x28], eax
jmp 0x140465319
call fcn.1404654b2
cmp dword [rbp + 0x20], 0
jmp 0x140465327
je 0x140465340
mov rbx, qword [rsp + 0x60]
adc bpl, r9b
btr bp, 0xea
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
jmp 0x140465347
call fcn.140465132
int3

Function at 0x1400edb00
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
stc
cmc
sub edx, edx
jmp 0x1401a1059
jmp 0x1404651c8
Function at 0x14013a8bc
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14016b6f8
jmp 0x1403fa839
push rsi
mov ah, 0x55
shld si, ax, 0x69
push rdi
bsf eax, r15d
sub rsp, 0x28
bts ax, sp
and eax, 0x7d103591
mov rsi, rcx
ror ah, 0x6b
not rax
cbw
mov rcx, qword [rcx + 0x18]
shl ax, 0x97
btr eax, ecx
mov rax, qword [rcx]
jmp 0x1403fa872
xor edx, edx
cmp r8d, r12d
test r12, 0xaff3d85
xor r8d, r8d
jmp 0x1403fa886
call qword [rax + 0x188]
mov edi, eax
jmp 0x1403fa893
lea rcx, [rsi + 0x30]
call fcn.14040e772
test edi, edi
je 0x1403fa8cb
cmp edi, 0x8899000c
jmp 0x1403fa8af
jne 0x1403fa8e9
mov rcx, rsi
add rsp, 0x28
mov si, di
pop rdi
jmp 0x1403fa8c5
pop rsi
jmp fcn.1403fa4e4
nop
stc
add rsp, 0x28
not dil
mov edi, 0x7c8b69ca
pop rdi
movzx si, r14b
bswap rsi
pop rsi
jmp 0x1403fa8e8
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
adc r9b, r8b
setg sil
mov dl, 3
test dl, r14b
bts r9w, sp
btr si, 0x60
mov r9d, 0x54
sar sil, cl
btc edi, r13d
add rsp, 0x28
cmova rsi, r14
mov esi, edi
movzx si, r13b
pop rdi
movsx esi, r11w
pop rsi
jmp 0x1403fa932
jmp fcn.140369490
Function at 0x1401b0390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmp al, 0x30
jne 0x14010bcd2
movzx eax, byte [rcx - 1]
dec rcx
test r14w, dx
cmp al, 0x30
jmp 0x14010bccc
je 0x14010141a
cmp al, r9b
lea rdx, [rcx - 1]
movsx eax, si
cmovne rdx, rcx
sbb al, 0xa
btr ax, 0x15
xor ah, 0x8a
nop dword [rax]
dec ah
sub ax, 0x5bc9
movzx eax, byte [r8]
cmc
test r8, 0x49e2340a
lea rdx, [rdx + 1]
cmp r15, 0x532a5e74
cmc
stc
mov byte [rdx], al
cmp r12b, dl
test r15d, 0x407f52b2
lea r8, [r8 + 1]
jmp 0x1401b44a0
jne 0x14010bcf7
ret
jne 0x14017450e
inc rcx
stc
test al, al
je 0x14014bbae
movzx eax, byte [rcx]
cmp r13d, 0x423755cc
test al, al
jmp 0x1401c9408
je 0x14015bded
movzx edx, al
sal ah, cl
btc rax, r11
nop dword [rax + rax]
xadd al, ah
shl ax, cl
movzx eax, dl
test dil, 0x5d
cmp dl, r9b
jmp 0x14023f8ff
mov rax, qword [rdx]
mov rdx, qword [rax + 0xf8]
mov rax, qword [rdx]
movzx r9d, byte [rax]
stc
inc rax
rol ax, 0xda
movzx eax, byte [rcx]
cmp bl, r10b
test al, al
jmp 0x1401744f4
test al, al
jmp 0x14014bba8
je 0x140239af8
sub al, 0x45
cmc
test al, 0xdf
jmp 0x140247e5f
jne 0x1401c940e
movzx eax, byte [rcx - 1]
movzx r8, cx
movzx r8w, cl
mov r8, rcx
jmp 0x14010140f
je 0x14015bded
movzx eax, byte [rcx + 1]
xchg dx, dx
inc rcx
xchg rdx, rdx
mov edx, 0xffe4203
shld dx, r15w, 0x35
movzx edx, al
test ebp, r8d
test al, al
jmp 0x14015bde7
je 0x140239af8
movzx eax, byte [rcx + 1]
inc rcx
clc
stc
test di, 0x668c
test al, al
jmp 0x140239af2

Function at 0x1401b31cc
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401c2ab5
movsxd rdx, dword [rcx + 0x3c]
cmp r15b, 0x60
cmp r11b, r9b
add rdx, rcx
cmp dword [rdx], 0x4550
jmp 0x14020cbe7
ret
sub eax, eax
jmp 0x1401b39a3
jne 0x1401c2ab5
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
jmp 0x14022c26e
ret