joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006f6b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18006f6dd
xor eax, eax
jmp 0x18006f849
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18006f717
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18006f717
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18006f849
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18006f83c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18006f75a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18006f785
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18006f841
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18006f7f4
sub eax, 1
je 0x18006f7f4
cmp eax, 2
jne 0x18006f83c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18006f841
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18006f822
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18006f83c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18006f841
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800defc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18006f870
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18006f943
cmp byte [rcx + 0x71], 0
je 0x18006f943
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18006f93f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18006f904
sub eax, 1
je 0x18006f908
cmp eax, 2
jne 0x18006f93f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800defc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18006f936
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18006f93f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18006f8ec
xor al, al
jmp 0x18006f8ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800defc0
add rsp, 0x60
pop rbx
ret

Function at 0x18006fb80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18006fbaf
xor eax, eax
mov qword [0x1801ee8f8], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x1800700f0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800747f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rdx
mov qword [rsp + 0x78], rdx
xor ebx, ebx
lea r14, [rcx + 8]
mov rcx, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x18]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, rdx
jb 0x180074923
lea r9, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
jbe 0x180074852
mov r9, qword [rbp + 0x28]
lea rax, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
jbe 0x180074861
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.180025860
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
movabs rcx, 0xcbf29ce484222325
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x1800748c3
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
xor rcx, rax
imul rcx, r9
inc rbx
cmp rbx, r8
jb 0x1800748b0
mov qword [rsp + 0x40], rcx
mov r9, rbp
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.180075b70
nop
lea rcx, [rsp + 0x48]
call fcn.180004060
nop
lea rcx, [rbp + 0x28]
call fcn.180004060
lea rcx, [rbp + 8]
call fcn.180004060
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800defc0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180025000
nop
int3
Function at 0x18007ba20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x18007ba89
mov rdi, qword [rcx + 0x60]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18007ba89
nop word [rax + rax]
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x20], xmm0
mov rcx, qword [0x1801ee2a8]
mov rax, qword [rcx + 0x38]
movq rdx, xmm0
mov rcx, qword [rcx + 0x30]
call rax
movups xmm0, xmmword [rsp + 0x20]
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rcx], rax
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18007ba50
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x18007bbd7
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rcx], rax
mov rdx, qword [rsi + 8]
mov r8, rdx
shr r8, 0x38
mov r9, rdx
shr r9, 0x30
mov r10, rdx
shr r10, 0x28
mov r11, rdx
shr r11, 0x20
mov rbx, rdx
shr rbx, 0x18
mov rdi, rdx
shr rdi, 0x10
mov rax, rdx
shr rax, 8
test rdx, rdx
je 0x18007bbd7
movzx ecx, dl
movabs rbp, 0xcbf29ce484222325
xor rcx, rbp
movabs rbp, 0x100000001b3
imul rcx, rbp
movzx eax, al
xor rcx, rax
imul rcx, rbp
movzx eax, dil
xor rcx, rax
imul rcx, rbp
movzx eax, bl
xor rcx, rax
imul rcx, rbp
movzx eax, r11b
xor rcx, rax
imul rcx, rbp
movzx eax, r10b
xor rcx, rax
imul rcx, rbp
movzx eax, r9b
xor rcx, rax
imul rcx, rbp
xor r8, rcx
imul r8, rbp
and r8, qword [0x18017cd90]
shl r8, 4
add r8, qword [0x18017cd78]
mov rcx, qword [r8 + 8]
mov r9, qword [0x18017cd68]
cmp rcx, r9
je 0x18007bb81
mov rax, qword [r8]
cmp rdx, qword [rcx + 0x10]
je 0x18007bb83
nop
cmp rcx, rax
je 0x18007bb81
mov rcx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x18007bb70
jmp 0x18007bb83
xor ecx, ecx
test rcx, rcx
je 0x18007bbd7
mov rax, qword [r8]
cmp qword [r8 + 8], rcx
jne 0x18007bba9
cmp rax, rcx
jne 0x18007bb9f
mov qword [r8], r9
mov qword [r8 + 8], r9
jmp 0x18007bbb4
mov r9, qword [rcx + 8]
mov qword [r8 + 8], r9
jmp 0x18007bbb4
cmp rax, rcx
jne 0x18007bbb4
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [0x18017cd70]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1800df358
lea rcx, [rsi + 0x58]
call fcn.180025c10
lea rcx, [rsi + 0x18]
call fcn.180025c10
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x18007bc0e
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18007bc00
call fcn.1800df358
mov edx, 0x20
mov rcx, rbx
call fcn.1800df358
nop
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18007c780
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18007c7b1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18017cd68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18017cd78]
lea rdx, [rdi + rdi]
call fcn.1800047a0
mov rax, qword [0x18017cd68]
lea r9, [rdi - 1]
mov qword [0x18017cd90], r9
mov qword [0x18017cd98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18007c952
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18017cd78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18007c89c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18007c913
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18007c8d9
mov r10, qword [rdx]
cmp r10, rax
je 0x18007c8d3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18007c913
cmp r9, rdx
je 0x18007c8ef
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18007c927
cmp r9, rdx
jne 0x18007c8e0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18007c94d
mov r9, qword [0x18017cd90]
jmp 0x18007c821
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18007c913
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a4cf0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1800a4d44
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.180024740
nop
mov rcx, qword [0x18017cc60]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 0xe
jb 0x1800a4f70
lea r14, [0x18017cc50]
mov rax, r14
cmp qword [0x18017cc68], 0xf
cmova rax, qword [0x18017cc50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str._Omar_Profile_
lea rcx, [rbp - 0x29]
call fcn.180025860
nop
mov r8d, 5
lea rdx, str..json
lea rcx, [rbp - 0x29]
call fcn.18002baa0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x49], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x59]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x17]
call fcn.18002baa0
nop
lea rcx, [rbp - 0x59]
call fcn.180004060
nop
lea rcx, [rbp - 0x29]
call fcn.180004060
mov rdi, qword [rbp + 0x27]
lea rbx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rbx, qword [rbp + 0x17]
call fcn.1800de594
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rdi
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp - 0x59]
call fcn.18006cd50
nop
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rcx, qword [rbp - 0x59]
call fcn.1800deca0
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1800a4f76
lea rcx, [rbp - 0x59]
call fcn.18006fb10
test bl, bl
je 0x1800a4f38
lea rax, [rbp - 9]
mov qword [rbp - 0x39], rax
mov rax, qword [0x18017cc60]
sub rsi, rax
cmp rsi, 0x15
jb 0x1800a4f6a
mov r9, r14
cmp qword [0x18017cc68], 0xf
cmova r9, qword [0x18017cc50]
mov qword [rsp + 0x30], 0x15
lea rcx, str._has_been_deleted__:_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 9]
call fcn.180025860
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov r8d, 7
lea rdx, str.Profile
lea rcx, [rbp - 0x59]
call fcn.180024740
nop
lea r8, [rbp - 9]
lea rdx, [rbp - 0x59]
mov rcx, qword [0x1801ee8d8]
call fcn.180074950
cmp qword [0x18017cc68], 0xf
cmova r14, qword [0x18017cc50]
mov qword [0x18017cc60], r15
mov byte [r14], 0
lea rcx, [rbp + 0x17]
call fcn.180004060
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800defc0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180025000
nop
call fcn.180025000
nop
shr rbx, 0x20
lea r8, [rbp - 0x59]
mov edx, ebx
lea rcx, str.remove
call fcn.18006d830
int3
jmp 0x1800a4cf0
Function at 0x1800c31c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1800a4d44
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.180024740
nop
mov rcx, qword [0x18017cc60]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 0xe
jb 0x1800a4f70
lea r14, [0x18017cc50]
mov rax, r14
cmp qword [0x18017cc68], 0xf
cmova rax, qword [0x18017cc50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str._Omar_Profile_
lea rcx, [rbp - 0x29]
call fcn.180025860
nop
mov r8d, 5
lea rdx, str..json
lea rcx, [rbp - 0x29]
call fcn.18002baa0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x49], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x59]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x17]
call fcn.18002baa0
nop
lea rcx, [rbp - 0x59]
call fcn.180004060
nop
lea rcx, [rbp - 0x29]
call fcn.180004060
mov rdi, qword [rbp + 0x27]
lea rbx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0xf
cmova rbx, qword [rbp + 0x17]
call fcn.1800de594
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rdi
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp - 0x59]
call fcn.18006cd50
nop
lea rcx, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rcx, qword [rbp - 0x59]
call fcn.1800deca0
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1800a4f76
lea rcx, [rbp - 0x59]
call fcn.18006fb10
test bl, bl
je 0x1800a4f38
lea rax, [rbp - 9]
mov qword [rbp - 0x39], rax
mov rax, qword [0x18017cc60]
sub rsi, rax
cmp rsi, 0x15
jb 0x1800a4f6a
mov r9, r14
cmp qword [0x18017cc68], 0xf
cmova r9, qword [0x18017cc50]
mov qword [rsp + 0x30], 0x15
lea rcx, str._has_been_deleted__:_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 9]
call fcn.180025860
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
mov r8d, 7
lea rdx, str.Profile
lea rcx, [rbp - 0x59]
call fcn.180024740
nop
lea r8, [rbp - 9]
lea rdx, [rbp - 0x59]
mov rcx, qword [0x1801ee8d8]
call fcn.180074950
cmp qword [0x18017cc68], 0xf
cmova r14, qword [0x18017cc50]
mov qword [0x18017cc60], r15
mov byte [r14], 0
lea rcx, [rbp + 0x17]
call fcn.180004060
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800defc0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180025000
nop
call fcn.180025000
nop
shr rbx, 0x20
lea r8, [rbp - 0x59]
mov edx, ebx
lea rcx, str.remove
call fcn.18006d830
int3
jmp 0x1800a4cf0
Function at 0x1800c3500
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 1
lea r8, str.https:__paingta.xyz_
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, str.https:__whatwhatboy.github.io_WWB_discordPain.html
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret
Function at 0x1800d3ba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx edi, dx
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [0x1801ee2a8]
cmp rax, qword [r9 + 0x1b8]
jne 0x1800d3c34
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1800d3c1a
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800d3c2d
cmp byte [0x1801eea98], 0
je 0x1800d3c0b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
imul rcx, rsi, 0x64
mov byte [0x1801eea98], 0
add rax, rcx
mov qword [0x1801eea90], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1801eea90]
jbe 0x1800d3c34
mov byte [rbx], 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [0x1801eea98], 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d4a30
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180162880]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1800d4bbe
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800d4bb3
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
jb 0x1800d4b94
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x3c], eax
jne 0x1800d4b94
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x38], eax
je 0x1800d4b94
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800d4b01
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x1801b8588]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x1800d4aff
jmp 0x1800d4bb3
jmp 0x1800d4b6b
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1800d4b6b
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801b8588]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800d4b4c
jmp 0x1800d4bb3
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x38]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x30], 0x1c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800d4a84
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800defc0
add rsp, 0x68
ret
Function at 0x1800d4be0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.1800d4a30
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800d4ca2
mov dword [rsp + 0x20], 0
jmp 0x1800d4c3f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800d4ca2
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d4ca0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1800d4880
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800d4c35
add rsp, 0x38
ret

Function at 0x1800d4cb0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800d4d3f
mov dword [rsp + 0x20], 0
jmp 0x1800d4cd8
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800d4d28
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d4d26
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800d4cce
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1801b8588]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x38
ret