joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400643d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r12
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [0x140103540]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x140104908]
lea rdx, [rsp + 0x30]
movss xmm1, dword [rcx + 0x2c]
mov rdi, rcx
movss xmm0, dword [rax + 0x1680]
mov r12, qword [rax + 0x1c00]
subss xmm1, xmm0
movaps xmm2, xmm0
movss xmm0, dword [rcx + 0x30]
addss xmm2, dword [rax + 0x1a60]
movss xmm6, dword [r12 + 0x118]
movss xmm7, dword [r12 + 0x11c]
movss dword [r12 + 0x11c], xmm0
movss dword [r12 + 0x118], xmm1
addss xmm2, dword [rcx + 0x2c]
movss dword [rcx + 0x2c], xmm2
xor ecx, ecx
movups xmm0, xmmword [rax + 0x1700]
movups xmmword [rsp + 0x30], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [0x1400a0de8]
movss dword [rsp + 0x3c], xmm0
call fcn.14002c180
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov ecx, 0x18
movups xmmword [rsp + 0x20], xmm0
call fcn.14002c180
xor edx, edx
lea rcx, [0x1400afb0c]
lea r8d, [rdx + 0x50]
call fcn.140054230
mov ecx, 2
movzx ebx, al
call fcn.14002b8e0
xor ebp, ebp
test bl, bl
je 0x1400645b0
mov eax, dword [rdi]
mov qword [rsp + 0xa8], rsi
mov esi, ebp
test eax, eax
jle 0x1400645a3
mov qword [rsp + 0xb0], r14
mov r14d, ebp
mov qword [rsp + 0x70], r15
mov r15d, ebp
test r14, r14
js 0x1400644f1
cmp esi, eax
jl 0x14006450a
mov r8d, 0x5cb
lea rdx, str.D:_reportimgui_dockingimgui.h
lea rcx, [0x1400a7890]
call fcn.140079664
mov rbx, qword [rdi + 8]
add rbx, r15
test dword [rbx + 4], 0x200000
jne 0x140064583
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140064528
mov rcx, qword [rcx]
jmp 0x14006455f
movsx eax, word [rbx + 0x24]
cmp ax, 0xffff
je 0x14006453a
cmp eax, dword [rdi + 0x88]
jl 0x140064553
mov r8d, 0x7e8
lea rdx, str.D:_reportimgui_dockingimgui_internal.h
lea rcx, str.tab__NameOffset____1___int_tab__NameOffset___TabsNames.Buf.Size
call fcn.140079664
movsx rcx, word [rbx + 0x24]
add rcx, qword [rdi + 0x90]
mov eax, dword [rbx]
lea r9, [rsp + 0x20]
cmp dword [rdi + 0x18], eax
mov qword [rsp + 0x20], 0
sete dl
xor r8d, r8d
call fcn.1400612b0
test al, al
cmovne rbp, rbx
mov eax, dword [rdi]
inc esi
inc r14
add r15, 0x30
cmp esi, eax
jl 0x1400644e8
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0xb0]
call fcn.1400204e0
mov rsi, qword [rsp + 0xa8]
movss dword [r12 + 0x118], xmm6
mov rax, rbp
movss dword [r12 + 0x11c], xmm7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140070fc0
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x78
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14006bc80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x1400cf071], 1
je 0x14006bd35
cmp byte [0x1400cf072], 1
je 0x14006bd5e
cmp byte [0x1400cf06c], 1
jne 0x14006bcbb
mov rax, qword [0x140104c10]
sub rax, qword [0x140104c08]
sar rax, 4
jmp 0x14006bd31
cmp byte [0x1400cf06d], 1
jne 0x14006bcd8
mov rax, qword [0x140104bb0]
sub rax, qword [0x140104ba8]
sar rax, 4
jmp 0x14006bd31
cmp byte [0x1400cf06e], 1
jne 0x14006bcf5
mov rax, qword [0x140104c58]
sub rax, qword [0x140104c50]
sar rax, 4
jmp 0x14006bd31
cmp byte [0x1400cf070], 1
jne 0x14006bd12
mov rax, qword [0x140104c40]
sub rax, qword [0x140104c38]
sar rax, 4
jmp 0x14006bd31
cmp byte [0x1400cf06f], 1
jne 0x14006bd2f
mov rax, qword [0x140104be0]
sub rax, qword [0x140104bd8]
sar rax, 4
jmp 0x14006bd31
xor eax, eax
cmp ecx, eax
jne 0x14006bd5e
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bd5e
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bd5e
add rsp, 0x28
jmp 0x14006e430
add rsp, 0x28
ret
sub rsp, 0x58
mov rax, qword [0x140103540]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x34], 4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], eax
lea r8d, [rax + 0x28]
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140070fc0
add rsp, 0x58
ret
Function at 0x14006bd70
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bdda
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bdda
cmp byte [0x1400cf0a2], 1
jne 0x14006bdda
cmp byte [0x1400cf0b4], 1
jne 0x14006bdda
cmp byte [0x1400cf06f], 1
je 0x14006bdc5
cmp byte [0x1400cf070], 1
je 0x14006bdc5
movsd xmm0, qword [str._np_ne__np_n_333333]
add rsp, 0x28
ret
movsd xmm0, qword [str._np_ne__np_n_333333]
addsd xmm0, qword [0x1400b12a0]
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006be40
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006be40
cmp byte [0x1400cf0a3], 1
jne 0x14006be40
cmp byte [0x1400cf0b4], 1
jne 0x14006be40
cmp byte [0x1400cf06f], 1
je 0x14006be2b
cmp byte [0x1400cf070], 1
je 0x14006be2b
movsd xmm0, qword [0x140103460]
add rsp, 0x28
ret
movsd xmm0, qword [0x140103460]
addsd xmm0, qword [0x1400b12c0]
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bea6
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bea6
cmp byte [0x1400cf0a1], 1
jne 0x14006bea6
cmp byte [0x1400cf0b4], 1
jne 0x14006bea6
cmp byte [0x1400cf06f], 1
je 0x14006be91
cmp byte [0x1400cf070], 1
je 0x14006be91
movsd xmm0, qword [0x140103470]
add rsp, 0x28
ret
movsd xmm0, qword [0x140103470]
addsd xmm0, qword [0x1400b1280]
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bf0c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bf0c
cmp byte [0x1400cf0a0], 1
jne 0x14006bf0c
movzx eax, byte [0x1400cf0b4]
cmp al, 1
jne 0x14006bf13
cmp byte [0x1400cf06f], al
je 0x14006bef7
cmp byte [0x1400cf070], al
je 0x14006bef7
movsd xmm0, qword [0x140103468]
add rsp, 0x28
ret
movsd xmm0, qword [0x140103468]
addsd xmm0, qword [0x1400b1290]
add rsp, 0x28
ret
movzx eax, byte [0x1400cf0b4]
test al, al
jne 0x14006bf24
movsd xmm0, qword [0x140103478]
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bf5a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bf5a
cmp byte [0x1400cf0b4], 1
jne 0x14006bf5a
movsd xmm0, qword [0x1400afe70]
add rsp, 0x28
ret
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006bf9e
cmp byte [0x1400cf0b4], 1
jne 0x14006bf9e
cmp byte [0x1400cf0b7], 1
jne 0x14006bf9e
cmp byte [0x1400cf071], 1
je 0x14006bf9b
cmp byte [0x1400cf072], 1
je 0x14006bf9b
movsd xmm0, qword [0x1400b12b0]
add rsp, 0x28
ret
xorps xmm0, xmm0
add rsp, 0x28
ret
Function at 0x14006db70
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dba1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dba1
cmp byte [0x1400cf072], 1
je 0x14006dc29
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dbbe
cmp byte [0x1400cf072], 1
je 0x14006dc4f
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dbe7
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dbe7
cmp byte [0x1400cf072], 1
je 0x14006dc29
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dc00
cmp byte [0x1400cf072], 1
je 0x14006dc4f
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dc36
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dc36
cmp byte [0x1400cf072], 1
jne 0x14006dc36
movss xmm0, dword [0x1400b1298]
add rsp, 0x28
ret
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dc5c
cmp byte [0x1400cf072], 1
jne 0x14006dc5c
movss xmm0, dword [0x1400b12d8]
add rsp, 0x28
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006dc82
cmp byte [0x1400cf072], 1
jne 0x14006dc82
movss xmm0, dword [0x1400a7a48]
add rsp, 0x28
ret
movss xmm0, dword [0x1400a7a64]
add rsp, 0x28
ret

Function at 0x14006dc90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140103540]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x14006dd22
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x14006dd01
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140070fc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14006e310
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e341
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e341
cmp byte [0x1400cf071], 1
je 0x14006e3c9
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e35e
cmp byte [0x1400cf071], 1
je 0x14006e3ef
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e387
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e387
cmp byte [0x1400cf071], 1
je 0x14006e3c9
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e3a0
cmp byte [0x1400cf071], 1
je 0x14006e3ef
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e3d6
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e3d6
cmp byte [0x1400cf071], 1
jne 0x14006e3d6
movss xmm0, dword [0x1400a7a4c]
add rsp, 0x28
ret
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e3fc
cmp byte [0x1400cf071], 1
jne 0x14006e3fc
movss xmm0, dword [0x1400a7a74]
add rsp, 0x28
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14006e422
cmp byte [0x1400cf071], 1
jne 0x14006e422
movss xmm0, dword [0x1400a7a48]
add rsp, 0x28
ret
movss xmm0, dword [0x1400a7a64]
add rsp, 0x28
ret

Function at 0x1400719a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400719ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400719ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400719ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400719ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400719ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400719f0
xor al, al
add rsp, 0x28
ret

Function at 0x140087c84
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140087b17
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140087b17
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140087b17
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140087b17
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140087b17
cmp dword [rcx + 0x84], 0xe
jbe 0x140087b17
cmp dword [rcx + 0xf8], 0
je 0x140087b17
mov ecx, ebx
call fcn.140087bb8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400879a8
cmp dword [rbp + 0x20], 0
je 0x140087b64
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140087b6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140087ab0
Function at 0x1807de058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807de1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1807de089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807de06f
add dl, dl
jne 0x1807de096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807de0f6
xor eax, eax
add dl, dl
jne 0x1807de0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807de1ad
add dl, dl
jne 0x1807de0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807de0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807de0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807de0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807de0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1807de07e
mov eax, 1
add dl, dl
jne 0x1807de106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807de113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807de0fb
sub eax, ebx
mov ebx, 1
jne 0x1807de14c
mov ecx, 1
add dl, dl
jne 0x1807de12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807de13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807de123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807de07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1807de168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807de175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807de15d
cmp eax, 0x7d00
jae 0x1807de19b
cmp eax, 0x500
jb 0x1807de196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807de07e
cmp eax, 0x7f
ja 0x1807de19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807de07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807de1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1807de07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x180001063
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
xor edi, edi
xor esi, esi
mov r11, rdx
dec r9
mov rbx, rcx
xor edx, edx
movsxd rcx, r10d
cmp rcx, r9
cmovne rdx, rsi
mov al, byte [rdx + r8]
lea rsi, [rdx + 1]
xor byte [rbx], al
xor eax, eax
cmp rcx, r9
cmovne eax, r10d
inc edi
inc rbx
lea r10d, [rax + 1]
movsxd rax, edi
cmp rax, r11
jb 0x180001024
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180001110
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1802af018]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rcx, 0xffffffffffffffff
mov rsi, rax
cmp rax, rcx
jne 0x18000118b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1802abb60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x7405c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18000116c
mov rax, qword [rsp + 0x48]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp rax, 0x3c
setle dil
mov eax, edi
jmp 0x18000116e

Function at 0x1802ab81c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x1802ab858
cmp edx, 1
jne 0x1802ab863
call fcn.180001110
and qword [rsp + 0x28], 0
lea r8, [0x1800011f4]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1802ab863
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1802ab870
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x1802af050], 0
jne 0x1802aba50
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1802aba5a
mov r8, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r8 + 0x88]
test ecx, ecx
je 0x1802ab8de
lea rdx, [r8 + rcx]
mov ecx, dword [r8 + rcx + 0xc]
mov eax, dword [rcx + r8]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1802ab8de
mov eax, dword [rcx + r8 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1802ab8ea
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
test rax, rax
jne 0x1802ab8a1
test rdx, rdx
je 0x1802aba5a
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r8
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x38], rdi
add rsi, r8
mov qword [rsp + 0x10], r12
mov r12d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r8
mov qword [rsp], r15
xor edx, edx
lea r15, [0x1802af050]
nop word [rax + rax]
lea eax, [rbx - 1]
mov r10d, dword [rsi + rax*4]
mov ebx, eax
add r10, r8
mov edi, eax
cmp word [r10], r12w
jne 0x1802ab9a1
xor r11d, r11d
mov r9d, 0xa3835048
mov rax, r10
movzx eax, word [rax]
mov ecx, r9d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, r10
xor r9d, ecx
cmp byte [rax], 0
jne 0x1802ab960
lea rcx, [rdx*8]
inc edx
mov dword [rcx + r15 + 4], r9d
movzx eax, word [rbp + rdi*2]
mov eax, dword [r14 + rax*4]
mov dword [rcx + r15 + 8], eax
cmp edx, 0x1f4
je 0x1802ab9a5
test ebx, ebx
jne 0x1802ab940
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r12, qword [rsp + 0x10]
xor r8d, r8d
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov dword [0x1802af050], edx
test eax, eax
je 0x1802aba42
nop dword [rax]
mov ecx, edx
xor eax, eax
sub ecx, r8d
cmp ecx, 1
je 0x1802aba37
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r15 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 8]
cmp edi, ebx
jbe 0x1802aba28
mov ecx, dword [r11 + r15 + 4]
mov eax, dword [r10 + r15 + 4]
mov dword [r11 + r15 + 4], eax
mov dword [r10 + r15 + 4], ecx
mov dword [r11 + r15 + 8], ebx
mov dword [r10 + r15 + 8], edi
mov edx, dword [0x1802af050]
mov ecx, edx
mov eax, r9d
sub ecx, r8d
dec ecx
cmp r9d, ecx
jb 0x1802ab9e0
inc r8d
lea eax, [rdx - 1]
cmp r8d, eax
jb 0x1802ab9d0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x1802abab0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [section..data]
call fcn.1802aba70
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r15, rcx
mov r14, r15
mov r13, r14
mov r10, r13
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
syscall
ret
Function at 0x140064520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400bcea0]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x140064581
cmp byte [rbx + 0x4a2e], 0
jne 0x140064581
movsx r9d, word [rbx + 0x5b2a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140053b70
test dil, 1
je 0x1400646a8
jmp 0x14006460a
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b2a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400b2588]
mulss xmm1, dword [0x1400b2570]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x1400b24a4]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
call fcn.140053b70
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140064660
lea r11, [0x1400a3a80]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140064643
cmp byte [r8], r9b
jne 0x140064643
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140064630
not ecx
call fcn.14005b8b0
test rax, rax
je 0x1400646a8
cmp byte [rax + 0xae], 0
je 0x1400646a8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b2a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b2a]
call fcn.140053b70
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14005dff0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14009f400
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400903f0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r12
push r13
mov eax, 0x1070
call fcn.1400a06e0
sub rsp, rax
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r12, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
jne 0x14009043c
mov rdx, rbp
jmp 0x140090550
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.14008f060
test al, al
je 0x140090434
mov qword [rsp + 0x1068], rsi
lea rdx, str.PAGE
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r14
mov qword [rsp + 0x1050], r15
nop
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140090480
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r15, rax
test r14d, r14d
je 0x140090525
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r15 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400904ee
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x1400904e0
cmp rdi, rax
je 0x1400904fe
inc esi
cmp esi, r14d
jae 0x140090525
lea rdx, str.PAGE
jmp 0x1400904c0
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140090525
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x40]
add rdx, rax
je 0x140090525
test ecx, ecx
je 0x140090525
lea rax, [rsp + 0x40]
mov ebp, ecx
sub rdx, rax
add rdx, r12
jmp 0x140090528
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r14, qword [rsp + 0x1058]
mov r15, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400902e0
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14009f400
add rsp, 0x1070
pop r13
pop r12
pop rbp
ret