joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movss xmm1, dword [rcx + 4]
cmp rdx, r8
je 0x42a0df
mov eax, dword [rcx]
test eax, eax
jle 0x42a0d3
lea r10d, [rax - 1]
mov r11, qword [rcx + 0x30]
xor eax, eax
jmp 0x42a0a3
mov rax, r9
movss xmm0, dword [rdx + rax*8 + 4]
movss xmm2, dword [rdx + rax*8]
movsx r9, word [r11 + rax*2]
mulss xmm2, xmm1
mulss xmm0, xmm1
lea r9, [r8 + r9*8]
movss dword [r9], xmm2
movss dword [r9 + 4], xmm0
lea r9, [rax + 1]
cmp rax, r10
jne 0x42a0a0
mov rdx, r8
add rsp, 0x28
jmp fcn.00429360
mov r8d, 0x244
lea rdx, str..._celt_kiss_fft.c
lea rcx, str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.0040b720
nop
nop dword [rax]
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, r8
cmp rdx, r8
je 0x42a1bc
mov eax, dword [rcx]
test eax, eax
jle 0x42a175
lea r8d, [rax - 1]
mov r10, qword [rcx + 0x30]
xor eax, eax
jmp 0x42a133
mov rax, rcx
movsx rcx, word [r10 + rax*2]
mov r9, qword [rdx + rax*8]
mov qword [rbx + rcx*8], r9
lea rcx, [rax + 1]
cmp r8, rax
jne 0x42a130
lea rax, [rbx + 4]
lea rdx, [rbx + r8*8 + 0xc]
movss xmm1, dword [0x0046f9d0]
nop word [rax + rax]
movss xmm0, dword [rax]
add rax, 8
xorps xmm0, xmm1
movss dword [rax - 8], xmm0
cmp rax, rdx
jne 0x42a160
mov rdx, rbx
mov rcx, rsi
call fcn.00429360
mov edx, dword [rsi]
test edx, edx
jle 0x42a1b5
sub edx, 1
lea rax, [rbx + 4]
movss xmm1, dword [0x0046f9d0]
lea rdx, [rbx + rdx*8 + 0xc]
nop word [rax + rax]
movss xmm0, dword [rax]
add rax, 8
xorps xmm0, xmm1
movss dword [rax - 8], xmm0
cmp rdx, rax
jne 0x42a1a0
add rsp, 0x28
pop rbx
pop rsi
ret
mov r8d, 0x253
lea rdx, str..._celt_kiss_fft.c
lea rcx, str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.0040b720
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42a100
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movss xmm1, dword [rcx + 4]
cmp rdx, r8
je 0x42a0df
mov eax, dword [rcx]
test eax, eax
jle 0x42a0d3
lea r10d, [rax - 1]
mov r11, qword [rcx + 0x30]
xor eax, eax
jmp 0x42a0a3
mov rax, r9
movss xmm0, dword [rdx + rax*8 + 4]
movss xmm2, dword [rdx + rax*8]
movsx r9, word [r11 + rax*2]
mulss xmm2, xmm1
mulss xmm0, xmm1
lea r9, [r8 + r9*8]
movss dword [r9], xmm2
movss dword [r9 + 4], xmm0
lea r9, [rax + 1]
cmp rax, r10
jne 0x42a0a0
mov rdx, r8
add rsp, 0x28
jmp fcn.00429360
mov r8d, 0x244
lea rdx, str..._celt_kiss_fft.c
lea rcx, str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.0040b720
nop
nop dword [rax]
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, r8
cmp rdx, r8
je 0x42a1bc
mov eax, dword [rcx]
test eax, eax
jle 0x42a175
lea r8d, [rax - 1]
mov r10, qword [rcx + 0x30]
xor eax, eax
jmp 0x42a133
mov rax, rcx
movsx rcx, word [r10 + rax*2]
mov r9, qword [rdx + rax*8]
mov qword [rbx + rcx*8], r9
lea rcx, [rax + 1]
cmp r8, rax
jne 0x42a130
lea rax, [rbx + 4]
lea rdx, [rbx + r8*8 + 0xc]
movss xmm1, dword [0x0046f9d0]
nop word [rax + rax]
movss xmm0, dword [rax]
add rax, 8
xorps xmm0, xmm1
movss dword [rax - 8], xmm0
cmp rax, rdx
jne 0x42a160
mov rdx, rbx
mov rcx, rsi
call fcn.00429360
mov edx, dword [rsi]
test edx, edx
jle 0x42a1b5
sub edx, 1
lea rax, [rbx + 4]
movss xmm1, dword [0x0046f9d0]
lea rdx, [rbx + rdx*8 + 0xc]
nop word [rax + rax]
movss xmm0, dword [rax]
add rax, 8
xorps xmm0, xmm1
movss dword [rax - 8], xmm0
cmp rdx, rax
jne 0x42a1a0
add rsp, 0x28
pop rbx
pop rsi
ret
mov r8d, 0x253
lea rdx, str..._celt_kiss_fft.c
lea rcx, str.assertion_failed:_fin___fout_nIn_place_FFT_not_supported
call fcn.0040b720
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x44e250
Capabilities:
Encode data using xor

Disassembly:
push r14
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edx, dword [rcx + 0x14]
mov rbx, rcx
test edx, edx
jne 0x44e340
mov edx, dword [rcx + 0xc]
mov eax, dword [rbx + 8]
mov r8d, dword [rbx + 0x10]
sub eax, edx
shl eax, 2
sub eax, r8d
mov edi, eax
mov qword [rsp + 0x28], rdi
je 0x44e330
mov rax, qword [rbx]
shl rdx, 2
mov ecx, r8d
add rcx, rdx
add rcx, rax
test r8d, r8d
je 0x44e2a5
add rdx, rax
mov eax, dword [rdx]
bswap eax
mov dword [rdx], eax
lea rdx, [rsp + 0x28]
mov r8, qword [rbx + 0x30]
call qword [rbx + 0x28]
test eax, eax
je 0x44e330
mov ecx, dword [rbx + 0xc]
mov r8d, dword [rbx + 0x10]
mov r9, qword [rsp + 0x28]
lea eax, [rcx*4]
lea edx, [r8 + r9 + 3]
add edx, eax
shr edx, 2
cmp ecx, edx
jae 0x44e30a
mov r10d, ecx
not ecx
mov r8, qword [rbx]
add edx, ecx
add rdx, r10
lea rax, [r8 + r10*4]
lea rcx, [r8 + rdx*4 + 4]
nop dword [rax]
mov edx, dword [rax]
add rax, 4
bswap edx
mov dword [rax - 4], edx
cmp rcx, rax
jne 0x44e2f0
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 0x10]
shl eax, 2
add eax, r8d
add eax, r9d
mov edx, eax
and eax, 3
shr edx, 2
mov dword [rbx + 0x10], eax
mov eax, 1
mov dword [rbx + 0xc], edx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
mov eax, dword [rcx + 0x20]
mov rbp, qword [rcx]
mov r10, rax
lea rcx, [rbp + rax*4]
mov eax, dword [rbx + 0x1c]
cmp edx, r10d
jbe 0x44e3d0
mov r8d, dword [rbx + 0x24]
test r8d, r8d
je 0x44e3d0
add r10d, 1
mov rsi, qword [0x0047c860]
mov r11d, 0x18
mov dword [rbx + 0x20], r10d
mov edi, dword [rcx]
cmp r8d, 0x1f
ja 0x44e426
mov ecx, r11d
mov r14d, edi
mov r9d, eax
shr eax, 8
sub ecx, r8d
shl r9d, 8
add r8d, 8
shr r14d, cl
movzx r9d, r9w
movzx ecx, r14b
xor eax, ecx
movzx eax, word [rsi + rax*2]
xor eax, r9d
cmp r8d, 0x1f
jbe 0x44e380
mov r8d, eax
mov dword [rbx + 0x1c], eax
mov eax, r10d
mov dword [rbx + 0x24], 0
lea rcx, [rbp + rax*4]
jmp 0x44e3d4
movzx r8d, ax
sub edx, r10d
call fcn.0044f7f0
mov esi, dword [rbx + 0x14]
mov edx, dword [rbx + 0x10]
mov dword [rbx + 0x20], 0
mov r8d, dword [rbx + 0xc]
movzx eax, ax
mov rcx, qword [rbx]
mov dword [rbx + 0x1c], eax
xor eax, eax
sub r8d, esi
test edx, edx
setne al
add r8d, eax
mov eax, esi
lea rdx, [rcx + rax*4]
shl r8d, 2
call sub.msvcrt.dll_memmove
mov edx, dword [rbx + 0xc]
mov dword [rbx + 0x14], 0
sub edx, esi
mov dword [rbx + 0xc], edx
jmp 0x44e26b
movzx r8d, ax
jmp 0x44e3b4
Function at 0x44e830
Capabilities:
Encode data using xor

Disassembly:
push r14
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
mov edx, dword [rcx + 0x14]
mov rbp, qword [rcx]
mov r11, rax
mov rbx, rcx
lea rcx, [rbp + rax*4]
mov eax, dword [rbx + 0x1c]
cmp edx, r11d
jbe 0x44e863
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jne 0x44e8e3
movzx r8d, ax
sub edx, r11d
call fcn.0044f7f0
mov r10d, dword [rbx + 0x18]
mov dword [rbx + 0x20], 0
movzx edx, ax
mov dword [rbx + 0x1c], edx
test r10d, r10d
je 0x44e8d8
mov r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov r11d, dword [rcx + r8*4]
mov r8d, dword [rbx + 0x24]
cmp r10d, r8d
jbe 0x44e8d8
mov r9, qword [0x0047c860]
mov esi, 0x18
mov ecx, esi
mov eax, r11d
sub ecx, r8d
add r8d, 8
shr eax, cl
mov ecx, edx
shl edx, 8
shr ecx, 8
movzx edx, dx
xor eax, ecx
movzx eax, al
movzx eax, word [r9 + rax*2]
xor edx, eax
cmp r10d, r8d
ja 0x44e8a5
mov dword [rbx + 0x1c], edx
mov eax, edx
mov dword [rbx + 0x24], r8d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r14
ret
add r11d, 1
mov r9, qword [0x0047c860]
mov esi, 0x18
mov dword [rbx + 0x20], r11d
mov edi, dword [rcx]
cmp r8d, 0x1f
ja 0x44e94b
nop
mov ecx, esi
mov r14d, edi
mov r10d, eax
shr eax, 8
sub ecx, r8d
shl r10d, 8
add r8d, 8
shr r14d, cl
movzx r10d, r10w
movzx ecx, r14b
xor eax, ecx
movzx eax, word [r9 + rax*2]
xor eax, r10d
cmp r8d, 0x1f
jbe 0x44e900
mov r8d, eax
mov dword [rbx + 0x1c], eax
mov eax, r11d
mov dword [rbx + 0x24], 0
lea rcx, [rbp + rax*4]
jmp 0x44e867
movzx r8d, ax
jmp 0x44e934

Function at 0x44f6c0
Capabilities:
Encode data using xor

Disassembly:
lea eax, [rdx - 1]
test edx, edx
je 0x44f6f0
lea r8, [rcx + rax + 1]
lea rdx, [0x0047a7c0]
xor eax, eax
add rcx, 1
xor al, byte [rcx - 1]
movzx eax, al
movzx eax, byte [rdx + rax]
cmp r8, rcx
jne 0x44f6d5
ret
xor eax, eax
ret

Function at 0x44f7f0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rdi
push rsi
push rbx
mov r14d, edx
mov eax, r8d
cmp edx, 1
jbe 0x44f8f4
lea r8d, [rdx - 2]
lea r9, [0x004797c0]
shr r8d, 1
lea r10, [rcx + r8*8 + 8]
nop word [rax + rax]
mov esi, dword [rcx]
mov r8d, dword [rcx + 4]
add rcx, 8
mov ebx, esi
mov edi, r8d
mov edx, esi
shr ebx, 0x10
shr edi, 0x18
xor ebx, eax
movzx eax, sil
movzx esi, dh
mov edx, r8d
movzx eax, word [r9 + rax*2 + 0x800]
movzx r11d, bl
movzx ebx, bh
xor ax, word [r9 + rdi*2 + 0x600]
movzx edi, r8b
xor ax, word [r9 + rdi*2]
xor ax, word [r9 + rsi*2 + 0xa00]
mov esi, r8d
shr esi, 0x10
movzx esi, sil
xor ax, word [r9 + rsi*2 + 0x400]
movzx esi, dh
xor ax, word [r9 + rsi*2 + 0x200]
xor ax, word [r9 + rbx*2 + 0xe00]
xor ax, word [r9 + r11*2 + 0xc00]
cmp rcx, r10
jne 0x44f820
and r14d, 1
test r14d, r14d
je 0x44f8ee
mov edx, dword [r10]
lea rcx, [0x004797c0]
mov ebx, edx
shr ebx, 0x10
xor eax, ebx
movzx ebx, dh
movzx edx, dl
movzx r8d, al
movzx eax, ah
movzx ebx, word [rcx + rbx*2 + 0x200]
xor bx, word [rcx + rdx*2]
xor bx, word [rcx + rax*2 + 0x600]
movzx eax, word [rcx + r8*2 + 0x400]
xor eax, ebx
pop rbx
pop rsi
pop rdi
pop r14
ret
mov r10, rcx
jmp 0x44f8ac
Function at 0x455d30
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x455d60
mov rax, qword [rcx]
mov byte [rax + 0x16], 0
mov rax, qword [rcx]
mov byte [rax + 0x17], 0
mov rax, qword [rcx]
mov byte [rax + 0x18], 0
mov rax, qword [rcx]
mov byte [rax + 0x19], 0
jmp fcn.00455900
ret

Function at 0x457260
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00462e00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00462e00
mov rdx, rbx
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x4572d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00487624]
mov rsi, rcx
mov rbp, rdx
mov rbx, r8
test edi, edi
jle 0x457470
mov rax, qword [0x00487628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x45731c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x4573a9
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x457300
mov rcx, rsi
call fcn.00458010
mov r12, rax
test rax, rax
je 0x4574a5
mov rax, qword [0x00487628]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00458150
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00487628]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4574b4
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4573a2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x457422
add dword [0x00487624], 1
cmp ebx, 8
jae 0x4573d5
test bl, 4
jne 0x457480
test ebx, ebx
je 0x4573ca
movzx eax, byte [rbp]
mov byte [rsi], al
test bl, 2
jne 0x457494
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
lea rcx, [rsi + 8]
and rcx, 0xfffffffffffffff8
mov qword [rsi], rax
mov eax, ebx
mov rdx, qword [rbp + rax - 8]
mov qword [rsi + rax - 8], rdx
sub rsi, rcx
add ebx, esi
sub rbp, rsi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x4573ca
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rbp + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x457405
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00487628]
mov r9, rdi
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4573a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00457260
nop word cs:[rax + rax]
xor edi, edi
jmp 0x457327
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rsi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rsi + rbx - 4], eax
jmp 0x4573ca
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rsi + rbx - 2], ax
jmp 0x4573ca
mov rdx, rsi
lea rcx, str.Address__p_has_no_image_section
call fcn.00457260
mov rax, qword [0x00487628]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00457260
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x457c60
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00487900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004878e0]
test rbx, rbx
je 0x457cb4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x457cab
test rsi, rsi
je 0x457cab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x457c90
lea rcx, [0x00487900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x458010
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x0047c940]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x45807f
mov rcx, r9
call fcn.00457ee0
test eax, eax
je 0x45807f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x45807d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x458074
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x45807f
add rdx, 0x28
cmp rdx, r9
jne 0x458060
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x1634490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x163449d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x16344ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1634495
lea eax, [rcx + 1]
jmp 0x16344bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x16344ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x16344b4
sub eax, 3
jb 0x16344ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x163453d
sar eax, 1
movsxd rbp, eax
jb 0x1634524
jmp 0x16344fc
add ebx, ebx
jne 0x16344fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1634524
inc ecx
add ebx, ebx
jne 0x163450a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1634524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x163451d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x163450c
add ecx, 2
jmp 0x1634529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01634452
jmp 0x163449d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1220000]
mov eax, dword [rdi]
or eax, eax
je 0x1634599
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1234000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1634549
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1634593
mov qword [rbx], rax
add rbx, 8
jmp 0x1634569
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x16345dd
cmp al, 0xef
ja 0x16345c5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x16345a5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x16345b4
mov eax, dword [rdi]
add rdi, 4
jmp 0x16345b4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1634631
sub rsp, 0xffffffffffffff80
jmp 0x46f920
Function at 0x180013ad0
Capabilities:
Create thread
Execute command

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rcx, str.color_9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n______________________________________________________________________________________________________________________n___________________________________________________________________________________n___________________________________________________________________n______________________________________________________________________________________n_________________________________________________________________________n___________________________________________________________________________________n______________________________________________________________________________n_______________________________________________________________________
call fcn.1800032f0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov r14, qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov dl, 0xa
call r14
mov r15, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
mov edx, eax
call r15
mov rbx, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rcx, rsi
call rbx
lea rsi, [0x180044300]
lea rdx, str.Initializing.
mov rcx, rsi
call fcn.1800032f0
lea rdi, [0x1800442f8]
mov rax, qword [0x180044300]
movsxd rax, dword [rax + 4]
lea rcx, [rax + rdi]
add rcx, 8
mov dl, 0xa
call r14
mov rcx, rsi
mov edx, eax
call r15
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.180002380
movzx ebx, byte [0x180044520]
test bl, bl
jne 0x180013bba
mov byte [0x180044520], 1
lea rax, [0x180044524]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x180015610]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180044528], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800143a0
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rdx, r8
call fcn.180014ae0
test rax, rax
je 0x18001445d
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x18001445d
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
lea rdi, [0x180044420]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0x100
lea r8, [rsp + 0x40]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov rcx, rdi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1800144f3
mov rdi, rax
cmp rax, 0xf
ja 0x180014477
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [0x180044420]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
jmp 0x1800144e0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x1800144e3
mov qword [rsi + 0x18], 0xf
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x1800144b4
lea rcx, [r14 + 0x28]
call fcn.18001a36c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800144c0
lea rcx, [r14 + 1]
call fcn.18001a36c
mov rbx, rax
mov qword [rsi], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [0x180044420]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.180002c30
int3

Function at 0x180014ae0
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x180044088]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rcx + 8], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x180014b7f
mov rbx, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180014b76
lea r15, [rsp + 0x54]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rsi, [rsp + 0x28]
nop
mov rcx, r15
mov rdx, rdi
call r12
test eax, eax
je 0x180014b6e
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180014b50
jmp 0x180014b76
mov eax, dword [rsp + 0x30]
mov dword [r14 + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r14 + 8], 0
je 0x180014b9b
lea rcx, [0x180014bd0]
mov rdx, r14
call qword [sym.imp.USER32.dll_EnumWindows]
mov rsi, qword [r14]
jmp 0x180014b9d
xor esi, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18001a480
mov rax, rsi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180019600
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180044088]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov edi, r15d
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800197a8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180019745
lea edi, [r15 + 1]
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180019700
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180019700
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180019700
mov rdx, qword [rbx]
test rdx, rdx
jne 0x1800196c2
mov dword [rbx + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x180044548]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180019728
jmp 0x1800196f3
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x1800196f3
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rbx + 8], eax
mov rcx, qword [0x180044548]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180019728
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180019670
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180019745
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x180019745
mov rcx, qword [0x180044548]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1800197a8
cmp qword [rbx], r15
je 0x1800197a3
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x1800197a3
mov rax, qword [rbx]
xor edx, edx
mov ecx, edi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18001979c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180019450
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180019760
mov eax, r15d
jmp 0x1800197ad
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18001a480
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret