joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800431c0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0xc0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1801b0238]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.180042420
nop
lea rax, vtable.PLH::VEHHook.0
mov qword [rbx], rax
mov dword [rbx + 0x38], 2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [rbx + 0x58], eax
lea rdx, [0x1800437d0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
test rax, rax
jne 0x1800432d6
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], al
lea r8d, [rax + 0x30]
lea rdx, str.PolyHook_VEH:_Failed_to_create_top_level_handler
lea rcx, [rsp + 0x60]
call fcn.18000f070
nop
lea rax, vtable.PLH::RuntimeError.0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov dword [rsp + 0x88], 2
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.18000ed80
nop
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.180042200
nop
lea rcx, [rsp + 0x90]
call fcn.18000ec30
nop
lea rcx, [rsp + 0x60]
call fcn.18000ec30
nop
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800e5f40
add rsp, 0xc0
pop rbx
ret
Function at 0x1800436c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
lea rcx, [0x18032e620]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x1800436f0
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov eax, dword [rbx + 0x38]
test eax, eax
jne 0x180043749
mov rcx, qword [rbx + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 1
mov dword [rsp + 0x38], 0x40
lea r9, [rsp + 0x3c]
lea edx, [rax + 1]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x40]
movzx eax, byte [rbx + 0x50]
mov byte [rcx], al
lea r9, [rsp + 0x3c]
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180043759
cmp eax, 1
jne 0x180043759
mov rax, qword [rbx + 0x40]
movzx ecx, byte [rax]
mov byte [rsp + 0x50], cl
mov r10, qword [0x18032e608]
lea r8, [rbx + 0x38]
mov rdx, r10
mov rcx, qword [0x18032e600]
call fcn.180043bd0
mov rbx, rax
cmp rax, r10
je 0x18004379f
mov rdi, qword [0x18032e608]
sub rdi, r10
mov r8, rdi
mov rdx, r10
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_memmove]
lea rax, [rdi + rbx]
mov qword [0x18032e608], rax
lea rcx, [0x18032e620]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test eax, eax
je 0x1800437b9
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800451a0
Capabilities:
Get graphical window text

Disassembly:
push rsi
sub rsp, 0x240
mov rax, qword [0x1801b0238]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x30]
or rax, 0xffffffffffffffff
lea r8, str.Battlefield
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x180045310
add rax, 2
cmp rax, 0xf
je 0x18004521b
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
je 0x1800451f0
jmp 0x180045310
mov rcx, qword [0x18032a6b0]
xor r8d, r8d
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x260], rdi
lea rdi, [rsi + 0xd0]
mov eax, dword [rcx + 0x10]
mov edx, dword [rcx + 0xc]
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r8
mov qword [rdi + 0x20], r8
mov dword [rdi + 0x28], r8d
mov dword [rsi + 0xd4], edx
mov dword [rsi + 0xd8], eax
imul edx, eax
mov dword [rdi], 0x28
mov qword [rsi + 0xdc], 0x180001
lea eax, [rdx + rdx*2]
mov dword [rsi + 0xe4], eax
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [rsi + 0xa0]
mov rbx, rax
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea r9, [rsi + 0x108]
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsi + 0xa0], rax
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov rcx, qword [rsi + 0xa0]
mov rdx, rax
mov qword [rsi + 0xb0], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdi, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x258]
mov byte [rsi + 8], 0
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800e5f40
add rsp, 0x240
pop rsi
ret
Function at 0x180045ef0
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1801b0238]
xor rax, rsp
mov qword [rsp + 0x240], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x40]
or rax, 0xffffffffffffffff
lea r8, str.Battlefield
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x180046024
add rax, 2
cmp rax, 0xf
je 0x180045f71
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
je 0x180045f33
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800e5f40
add rsp, 0x258
ret
mov qword [rsp + 0x260], rbx
xor ecx, ecx
mov qword [rsp + 0x250], rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [0x18032a6b0]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov rbx, rax
mov ecx, dword [rdx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rdx + 0x10]
add rdx, 0x570
mov dword [rsp + 0x3c], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp qword [rdx + 0x18], 8
jb 0x180045fc4
mov rdx, qword [rdx]
lea r9, [rsp + 0x30]
mov r8, rbx
call fcn.180045560
mov rcx, qword [0x18032a6b0]
mov qword [rsp + 0x30], rdi
mov rdi, qword [rsp + 0x250]
mov eax, dword [rcx + 0xc]
lea rdx, [rcx + 0x590]
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x3c], eax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
jb 0x18004600f
mov rdx, qword [rdx]
lea r9, [rsp + 0x30]
mov r8, rbx
call fcn.180045560
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800e5f40
add rsp, 0x258
ret
Function at 0x180051430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
movzx eax, byte [rcx + 4]
movsxd r8, edx
mov dword [rsp], 0x5100a02
mov dword [rsp + 4], 0x40d0901
lea rdx, [rax + 1]
mov dword [rsp + 8], 0xd5d4d3d2
shl rdx, 4
add rdx, rcx
mov dword [rbp - 0x7d], 0xd9d8d7d6
inc al
mov dword [rbp - 0x79], 0xf2e0730
mov byte [rcx + 4], al
mov dword [rbp - 0x75], 0x8120c03
mov dword [rbp - 0x71], 0xe2d062f
mov dword [rbp - 0x6d], 0xe5e4e3e2
mov dword [rbp - 0x69], 0xe9e8e7e6
mov dword [rbp - 0x65], 0x15181613
mov dword [rbp - 0x61], 0x171d141e
mov dword [rbp - 0x5d], 0xdddcdbda
mov dword [rbp - 0x59], 0xe1e0dfde
mov dword [rbp - 0x55], 0x25282623
mov dword [rbp - 0x51], 0x272b242c
mov dword [rbp - 0x4d], 0x65646362
mov dword [rbp - 0x49], 0x69686766
mov dword [rbp - 0x45], 0x5d5c5b5a
mov dword [rbp - 0x41], 0x61605f5e
mov dword [rbp - 0x3d], 0x75747372
mov dword [rbp - 0x39], 0x79787776
mov dword [rbp - 0x35], 0x7d7c7b7a
mov dword [rbp - 0x31], 0x81807f7e
mov dword [rbp - 0x2d], 0x85848382
mov dword [rbp - 0x29], 0x89888786
mov dword [rbp - 0x25], 0x8d8c8b8a
mov dword [rbp - 0x21], 0x91908f8e
mov dword [rbp - 0x1d], 0x95949392
mov dword [rbp - 0x19], 0x99989796
mov dword [rbp - 0x15], 0x9d9c9b9a
mov dword [rbp - 0x11], 0xa1a09f9e
mov dword [rbp - 0xd], 0xa5a4a3a2
mov dword [rbp - 9], 0xa9a8a7a6
mov dword [rbp - 5], 0xadacabaa
mov dword [rbp - 1], 0xb1b0afae
mov dword [rbp + 3], 0xb5b4b3b2
mov dword [rbp + 7], 0xb9b8b7b6
mov dword [rbp + 0xb], 0xbdbcbbba
mov dword [rbp + 0xf], 0xc1c0bfbe
mov dword [rbp + 0x13], 0xc5c4c3c2
mov dword [rbp + 0x17], 0xc9c8c7c6
mov dword [rbp + 0x1b], 0xcdcccbca
mov dword [rbp + 0x1f], 0xd1d0cfce
mov dword [rbp + 0x23], 0x55545352
mov dword [rbp + 0x27], 0x59585756
mov dword [rbp + 0x2b], 0x11310b1c
mov dword [rbp + 0x2f], 0x43422120
mov dword [rbp + 0x33], 0x47464544
mov dword [rbp + 0x37], 0x33324948
mov dword [rbp + 0x3b], 0x37363534
mov dword [rbp + 0x3f], 0x3b3a3938
mov dword [rbp + 0x43], 0x3f3e3d3c
mov dword [rbp + 0x47], 0x294140
movzx ecx, byte [rsp + r8]
mov dword [rdx + 8], ecx
mov byte [rdx + 4], 1
add rsp, 0xe0
pop rbp
ret
Function at 0x1800b59f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov r15d, edx
inc r15
lea ecx, [rdx + 1]
inc rcx
add r15, r15
add rcx, rcx
mov r14, r8
mov ebp, dword [rsi + rcx*8 + 8]
shr ebp, 8
not ebp
and ebp, 1
cmp dword [rsi + r15*8 + 8], 0
je 0x1800b5b46
test ebp, ebp
mov qword [rsp + 0x40], rdi
lea rcx, [0x180188db8]
lea rax, [0x180187ba0]
cmove rax, rcx
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800b5a53
movsxd rcx, dword [r14 + 0x200]
mov rdx, rax
add rcx, r14
mov r8d, edi
call sub.VCRUNTIME140.dll_memcpy
add dword [r14 + 0x200], edi
movsxd rax, dword [r14 + 0x200]
mov byte [rax + r14], 0
mov rax, qword [rsi + 0x320]
mov ecx, dword [rsi + r15*8 + 8]
call qword [rax + 0x80]
mov rdi, qword [rsp + 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800b5aa0
movsxd rcx, dword [r14 + 0x200]
mov rdx, rax
add rcx, r14
mov r8d, ebx
call sub.VCRUNTIME140.dll_memcpy
add dword [r14 + 0x200], ebx
movsxd rax, dword [r14 + 0x200]
mov byte [rax + r14], 0
mov rax, qword [rsi + 0x320]
cmp dword [rax + 0x68], 0
je 0x1800b5bfd
mov rax, qword [rsi + 0x310]
xor bpl, 1
mov rdx, qword [rax + 0xe8]
movzx eax, byte [rdx + 0x50]
lea rcx, [rax + rax*4]
mov dword [rdx + rcx*8 + 0x64], 1
mov rax, qword [rsi + 0x310]
mov rdx, qword [rax + 0xe8]
movzx eax, byte [rdx + 0x50]
lea rcx, [rax + rax*4]
mov eax, dword [rsi + r15*8 + 8]
mov dword [rdx + rcx*8 + 0x68], eax
mov rax, qword [rsi + 0x310]
mov rcx, qword [rax + 0xe8]
movzx eax, byte [rcx + 0x50]
add rax, 3
lea rax, [rax + rax*4]
mov byte [rcx + rax*8], bpl
jmp 0x1800b5bec
movzx ebx, byte [rsi + rcx*8 + 8]
lea r8, [0x180187ba0]
lea rcx, [0x180188db8]
mov r9d, ebx
lea rdx, str._s0x_x
cmp ebx, 9
ja 0x1800b5b6f
lea rdx, str._s_u
test ebp, ebp
cmove r8, rcx
mov rcx, r14
call fcn.1800480b0
mov rax, qword [rsi + 0x320]
cmp dword [rax + 0x68], 0
je 0x1800b5bfd
mov rax, qword [rsi + 0x310]
mov rdx, qword [rax + 0xe8]
movzx eax, byte [rdx + 0x50]
lea rcx, [rax + rax*4]
mov dword [rdx + rcx*8 + 0x64], 2
mov rax, qword [rsi + 0x310]
mov rdx, qword [rax + 0xe8]
movzx eax, byte [rdx + 0x50]
lea rcx, [rax + rax*4]
test ebp, ebp
je 0x1800b5be6
mov dword [rdx + rcx*8 + 0x68], ebx
mov rax, qword [rsi + 0x310]
mov rcx, qword [rax + 0xe8]
movzx eax, byte [rcx + 0x50]
add rax, 3
lea rax, [rax + rax*4]
mov byte [rcx + rax*8], 1
jmp 0x1800b5bec
neg ebx
mov dword [rdx + rcx*8 + 0x68], ebx
mov rax, qword [rsi + 0x310]
mov rcx, qword [rax + 0xe8]
inc byte [rcx + 0x50]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1800d3a40
Capabilities:
Decompress data using quicklz

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, edx
mov r11, rcx
shr edx, 0x16
mov ebx, 3
and edx, 0xf
lea eax, [rdx - 0xe]
cmp eax, 1
mov eax, r10d
jbe 0x1800d3b00
and eax, 0x800
mov r9d, r10d
shl eax, 8
and r9d, 0x7ff
add r9d, r9d
or r9d, eax
mov eax, r10d
and eax, 0x2000
shl eax, 5
or r9d, eax
mov eax, r10d
shr eax, 4
and eax, 0x3f000
shl r10d, 5
or r9d, eax
movzx eax, byte [rcx + 4]
shl r9d, 0xb
lea r8, [rax + 1]
inc al
mov byte [rcx + 4], al
add r8, r8
movsxd rax, r9d
mov byte [rcx + r8*8 + 4], 2
movsxd rcx, r10d
and rcx, 0xffffffff800007ff
or rcx, rax
sar rcx, 0xb
mov qword [r11 + r8*8 + 8], rcx
mov rcx, r11
call fcn.1800cca60
test eax, eax
je 0x1800d3b14
sub eax, 1
je 0x1800d3af3
cmp eax, 2
je 0x1800d3b6b
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
ret
shr eax, 4
sub eax, 0xf3bf8f4
je 0x1800d3b2e
sub eax, 1
je 0x1800d3b25
cmp eax, 1
je 0x1800d3b1c
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rcx + 8], 0x922
jmp 0x1800d3b35
mov dword [rcx + 8], 0x91c
jmp 0x1800d3b35
mov dword [rcx + 8], 0x91d
and r10d, 0xf
test r10d, 0xfffffff0
je 0x1800d3b4c
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
movzx ecx, byte [rcx + 4]
lea rdx, [rcx + 1]
add rdx, rdx
inc cl
mov byte [r11 + 4], cl
mov ecx, r10d
mov qword [r11 + rdx*8 + 8], rcx
mov byte [r11 + rdx*8 + 4], 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1800df110
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rdi
sub rsp, 0xa0
movaps xmm0, xmmword [0x18018a080]
movaps xmm4, xmm2
mov ebx, dword [rcx + 0x48]
mov rdi, rdx
movss xmm2, dword [rcx + 0x38]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmm9, xmmword [rcx]
movaps xmmword [rax - 0x58], xmm10
movaps xmm6, xmm9
movaps xmmword [rax - 0x68], xmm11
xorps xmm10, xmm10
movaps xmm11, xmmword [rcx + 0x10]
movaps xmm1, xmm10
shufps xmm6, xmm9, 0xee
movaps xmm7, xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmm12, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x20], xmm13
movaps xmm8, xmm12
movaps xmm13, xmmword [rcx + 0x20]
shufps xmm7, xmm11, 0xee
cmpeqps xmm1, xmm6
andps xmm0, xmm1
andnps xmm1, xmm6
orps xmm0, xmm1
divps xmm8, xmm0
test bl, 4
je 0x1800df1ab
mulps xmm9, xmm3
mulps xmm6, xmm3
jmp 0x1800df1af
mulps xmm8, xmm3
test bl, 8
jne 0x1800df1b7
mulps xmm7, xmm4
xorps xmm0, xmm0
ucomiss xmm2, xmm0
je 0x1800df1f9
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xb0]
call fcn.1800df600
movss xmm0, dword [rsp + 0xb0]
movaps xmm2, xmm0
movss xmm0, dword [rsp + 0xb8]
subps xmm10, xmm2
movaps xmm3, xmm0
unpcklps xmm3, xmm2
unpcklps xmm10, xmm0
jmp 0x1800df208
movaps xmm3, xmmword [0x1801886b0]
movaps xmm10, xmmword [0x1801886c0]
and ebx, 3
lea r11, [0x1801b0160]
mov r10d, ebx
xor r8d, r8d
mov r9, r11
nop dword [rax + rax]
movaps xmm1, xmmword [r9]
mov rax, r10
subps xmm1, xmm8
movsxd rcx, r8d
xor rax, rcx
inc r8d
add rax, rax
add r9, 0x10
lea rdx, [rcx + rcx*8]
mulps xmm1, xmm7
movaps xmm0, xmm1
shufps xmm0, xmm1, 0
mulps xmm0, xmm3
shufps xmm1, xmm1, 0x55
mulps xmm1, xmm10
addps xmm0, xmm11
addps xmm0, xmm1
shufps xmm0, xmm12, 0xb4
movups xmmword [rdi + rdx*4], xmm0
movups xmmword [rdi + rdx*4 + 0xc], xmm13
movaps xmm0, xmmword [r11 + rax*8]
mulps xmm0, xmm6
addps xmm0, xmm9
movss dword [rdi + rdx*4 + 0x1c], xmm0
shufps xmm0, xmm0, 0x55
movss dword [rdi + rdx*4 + 0x20], xmm0
cmp r8d, 4
jb 0x1800df220
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rdi
ret

Function at 0x1800e66f8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x180343de0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x180343e0d
xor al, al
jmp 0x180343f6f
mov rax, qword [0x180364700]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x180364708]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x180364710]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x180364718]
mov qword [rcx + 0x18], rax
mov rax, qword [0x180364720]
mov qword [rcx + 0x20], rax
mov rax, qword [0x180364728]
mov qword [rcx + 0x28], rax
mov rax, qword [0x180364730]
mov qword [rcx + 0x30], rax
mov rax, qword [0x180364738]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x180364740]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x180343f61
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x180343eb9
mov r11d, 2
jmp 0x180343edd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x180343ed3
mov r11d, 1
jmp 0x180343edd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x180343f85
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x180343f22
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x180343f3a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x180343f4a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x180343f58
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x180343ea0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x180343f6a
Function at 0x140002f60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002fbd
lea rbx, [0x1400c7c70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002fa4
cmp r10, 2
jb 0x140002fa4
cmp byte [r9], r8b
jne 0x140002fa4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002f80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002fff
lea rbx, [0x1400c7c70]
cmp r8b, 0x23
jne 0x140002fe3
cmp byte [r9], r8b
jne 0x140002fe3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002fd0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000315a
mov qword [r8], 0
lea rdx, [0x1400c79ac]
call fcn.140003010
mov rbx, rax
test rax, rax
jne 0x14000317a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003251
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003251
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003251
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003251
cmp rdi, 0xffffffffffffffff
je 0x140003251
mov rax, qword [0x1400f1340]
test rax, rax
je 0x1400031ee
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003251
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000323e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400f1340]
test rax, rax
je 0x140003233
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000325a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000324c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000325c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005320
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400c7c70]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1400f1340]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x1c6c], ebx
jne 0x1400053ad
mov dword [rax + 0x1c70], ebx
cmp dword [rax + 0x1ca8], ebx
jne 0x1400053bc
mov byte [rax + 0x1cac], 1
cmp dword [rax + 0x1c54], ebx
jne 0x1400053d3
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140015be0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000fea0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f0080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400f1340]
mov edi, ecx
cmp byte [rbx + 0x1fad], 0
jne 0x14000ff01
cmp byte [rbx + 0x1fae], 0
jne 0x14000ff01
movsx r9d, word [rbx + 0x308e]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002ee0
test dil, 1
je 0x140010028
jmp 0x14000ff8a
movss xmm1, dword [rbx + 0x1628]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x308e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400dec18]
mulss xmm1, dword [0x1400debf8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d30], rax
mov dword [rbx + 0x1d1c], 1
movss dword [rbx + 0x1d28], xmm0
movss dword [rbx + 0x1d2c], xmm1
movss xmm0, dword [rbx + 0x1684]
mulss xmm0, dword [0x1400deb3c]
or dword [rbx + 0x1d18], 0x41
movss dword [rbx + 0x1d78], xmm0
call fcn.140002ee0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14000ffe0
lea r11, [0x1400c7c70]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14000ffc3
cmp byte [r8], r9b
jne 0x14000ffc3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14000ffb0
not ecx
call fcn.140009d60
test rax, rax
je 0x140010028
cmp byte [rax + 0x8e], 0
je 0x140010028
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
jns 0x14001000d
add dh, al
xor byte [rax + 0x1000000], 0x48
lea ecx, [rsp + 0x20]
inc word [rbx + 0x308e]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x308e]
call fcn.140002ee0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c250
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b3da0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400149b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3130], 0
lea rbx, [rcx + 0x3138]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140014a57
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140014a0a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140016970
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003790
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3130]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3140]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400f1338]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140014a5f
mov rcx, rbx
call fcn.140003790
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret