joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003bbac
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x14007ac80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x14003bc06
cmp dword [rsp + 0x90], 0x7c
jge 0x14003bc06
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x1400798f0]
call fcn.14003beb4
nop
lea rcx, [rsp + 0x50]
call fcn.1400343f0
nop
cmp qword [rsp + 0x30], 0
jne 0x14003bc2d
lea rdx, [0x140052f10]
lea rcx, [rsp + 0x50]
call fcn.140034d8c
nop
jmp 0x14003bc3d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140034d8c
nop
cmp dword [rsp + 0xa0], 1
jne 0x14003bc59
lea rdx, [0x140052f20]
lea rcx, [rsp + 0x50]
call fcn.140034d8c
nop
movss xmm2, dword [0x140050fec]
movss xmm1, dword [0x140072548]
lea rcx, [rsp + 0x48]
call fcn.140034800
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14003f3a8
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140025a4c
movzx eax, al
test eax, eax
je 0x14003bcce
cmp dword [rsp + 0xa0], 0
jne 0x14003bcce
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.140034be0
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140049540
add rsp, 0x88
ret

Function at 0x14003bcf0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140071668]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140071658]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003bd79
lea rcx, [0x140071680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003bd79
lea rcx, [0x140071694]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003bd79
xor al, al
jmp 0x14003be2b
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400716a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003bdfb
lea rcx, [0x1400716d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003bdfb
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400716e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003bdfb
xor al, al
jmp 0x14003be2b
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14007b5f8]
call fcn.14004a190
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x14007b618]
call fcn.14004a190
mov al, 1
add rsp, 0x38
ret
Function at 0x14003d26c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003d29e
xor eax, eax
jmp 0x14003d2f4
mov r8d, 0x1e
lea rdx, [0x14007b618]
mov rcx, qword [rsp + 0x28]
call fcn.14004a190
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14003e6dc
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14003e70c
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14003e78e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14003e75a
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14003e762
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14003e701
mov qword [rsp + 8], 0xe3
jmp 0x14003e7a6
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14003e82d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14003e7f7
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14003e7ff
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14003e799
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14003e881
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14003e889
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14003e8d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14003e8f1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14003e975
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14003e940
mov dword [rsp + 4], 0x9908b0df
jmp 0x14003e948
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14003e8e4
add rsp, 0x18
ret
Function at 0x140041190
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x14007ac80]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14004121f
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14004120c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov dword [0x14007b530], eax
mov eax, dword [rsp + 0x38]
jmp 0x14004122c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400411da
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140049540
add rsp, 0x178
ret
Function at 0x140047280
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14003d934]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14003df04]
mov qword [rsp + 0x78], rax
lea rax, [0x140051118]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x140047339
lea rdx, str._n_n_Notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140030e7c
nop
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.Notepad
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x14007b668], rax
mov edx, 5
mov rcx, qword [0x14007b668]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140051108]
mov rcx, qword [0x14007b668]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x14007b668]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x14007b668]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
add rsp, 0xc0
pop rdi
ret
Function at 0x140049d68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140049db2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140049db2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140049db2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140049db2
cmp dword [rcx + 0x84], 0xe
jbe 0x140049db2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140049db4
xor al, al
add rsp, 0x28
ret
Function at 0x140008758
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov eax, dword [0x14000c2d0]
lea r9, [rsp + 0x20]
movups xmm0, xmmword [str.rvvrrrrvvrr]
mov dword [rsp + 0x40], eax
xor r8d, r8d
movups xmm1, xmmword [0x14000c2c0]
mov al, byte [0x14000c2d4]
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x44], al
movups xmmword [rsp + 0x30], xmm1
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x25
jl 0x140008796
xor ebx, ebx
lea rdi, [0x14000c760]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
call fcn.14000a2c4
cmp byte [rsp + 0x44], 0
je 0x14000880d
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x25
jl 0x1400087e6
call fcn.14000a2d8
mov r8d, eax
inc ebx
mov eax, 0x38e38e39
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*8]
shl ecx, 2
sub r8d, ecx
movsxd rcx, r8d
mov dl, byte [rsp + rcx + 0x20]
mov byte [rdi], dl
inc rdi
cmp ebx, 0xd
jb 0x1400087c6
mov rbx, qword [rsp + 0x60]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x140009a3c
Capabilities:
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov r9d, ecx
test ecx, ecx
je 0x140009b76
test rdx, rdx
je 0x140009b76
and qword [rbp + 0x7f], 0
xor eax, eax
mov dword [rbp - 0x39], 0xa37d6f7a
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x35], 0x39323415
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x77]
movabs rcx, 0x490c80bfc38e8ce6
mov rax, qword [rbp + 0x77]
add rcx, rdx
movzx r8d, byte [rbp + rax - 0x39]
mov rax, rcx
and rax, r8
imul rdx, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x77]
add rdx, rcx
add rdx, r8
sub dl, 0x4a
mov byte [rbp + rax - 0x39], dl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0x10
jb 0x140009a83
mov rax, qword [rbp - 0x39]
lea rdx, [rbp + 0x7f]
xor rax, qword [0x14000c610]
mov rcx, r9
call rax
test eax, eax
js 0x140009b76
mov rcx, qword [rbp + 0x7f]
call fcn.140009280
test rax, rax
jne 0x140009b81
mov qword [rbp + 0xf], rax
mov word [rbp + 0x17], ax
mov dword [rbp + 7], 0x96c9cc91
mov dword [rbp + 0xb], 0x49a7fe43
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x77]
movabs rcx, 0xb3eb466931dba597
mov rax, qword [rbp + 0x77]
add rcx, rdx
movzx r8d, byte [rbp + rax + 7]
mov rax, rcx
and rax, r8
imul rdx, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x77]
add rdx, rcx
add rdx, r8
sub dl, 0x21
mov byte [rbp + rax + 7], dl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0x12
jb 0x140009b1a
mov rax, qword [rbp + 7]
xor rax, qword [0x14000c640]
mov rcx, qword [rbp + 0x7f]
call rax
xor eax, eax
add rsp, 0xc0
pop rbp
ret
mov rcx, qword [rbp + 0x7f]
lea rdx, [rbp + 0x27]
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rbp - 0x29], 0
lea r9, [rbp + 0x6f]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea rdx, [rbp - 0x29]
mov dword [rsp + 0x20], 0x3000
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov r8, qword [rbp + 0x6f]
mov edx, 0xcc
mov rcx, qword [rbp - 0x29]
call fcn.14000a484
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
mov dword [rbp - 0x19], 0x602d2a65
mov qword [rbp - 0x11], rax
mov word [rbp - 9], ax
mov byte [rbp - 7], al
mov dword [rbp - 0x15], 0x993f149b
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x77]
movabs rcx, 0xa74313d646723974
mov rax, qword [rbp + 0x77]
add rcx, rdx
movzx r8d, byte [rbp + rax - 0x19]
mov rax, rcx
and rax, r8
imul rdx, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x77]
add rdx, rcx
add rdx, r8
sub dl, 0x2c
mov byte [rbp + rax - 0x19], dl
mov rax, qword [rbp + 0x77]
inc rax
mov qword [rbp + 0x77], rax
mov rax, qword [rbp + 0x77]
cmp rax, 0x13
jb 0x140009c07
mov rax, qword [rbp - 0x19]
xor rax, qword [0x14000c640]
mov rcx, qword [rbp + 0x7f]
call rax
mov rax, qword [rbp - 0x29]
jmp 0x140009b78
Function at 0x14000a164
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 1], 0
lea rdx, [rbp - 1]
mov ecx, ecx
mov ebx, r9d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000a19e
xor al, al
jmp 0x14000a26a
mov rcx, qword [rbp - 1]
lea rdx, [rbp + 0x27]
and dword [rbp + 0x67], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rax, [rbp + 0x67]
mov r9d, ebx
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x6f]
or rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwProtectVirtualMemory
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
mov dword [rbp + 7], 0x3c797221
mov word [rbp + 0x1f], ax
xorps xmm0, xmm0
mov byte [rbp + 0x21], al
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0xb], 0xed4f88f3
mov qword [rbp - 9], rax
mov rax, qword [rbp - 9]
mov rdx, qword [rbp - 9]
movabs rcx, 0xc03c5080c637fb8a
mov rax, qword [rbp - 9]
add rcx, rdx
movzx r8d, byte [rbp + rax + 7]
mov rax, rcx
and rax, r8
imul rdx, rax, 0xfffffffffffffffe
add rdx, rcx
mov rcx, qword [rbp - 9]
add rdx, r8
add dl, 0x3a
mov byte [rbp + rcx + 7], dl
mov rcx, qword [rbp - 9]
inc rcx
mov qword [rbp - 9], rcx
mov rcx, qword [rbp - 9]
cmp rcx, 0x1b
jb 0x14000a20c
mov rdx, qword [rbp + 7]
xor rdx, qword [0x14000c640]
mov rcx, qword [rbp - 1]
call rdx
mov al, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
Function at 0x14244b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14244b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14244b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14244b06f
add dl, dl
jne 0x14244b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14244b0f6
xor eax, eax
add dl, dl
jne 0x14244b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14244b1ad
add dl, dl
jne 0x14244b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14244b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14244b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14244b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14244b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14244b07e
mov eax, 1
add dl, dl
jne 0x14244b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14244b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14244b0fb
sub eax, ebx
mov ebx, 1
jne 0x14244b14c
mov ecx, 1
add dl, dl
jne 0x14244b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14244b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14244b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14244b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14244b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14244b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14244b15d
cmp eax, 0x7d00
jae 0x14244b19b
cmp eax, 0x500
jb 0x14244b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14244b07e
cmp eax, 0x7f
ja 0x14244b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14244b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14244b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14244b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001da8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001df2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001df2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001df2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001df2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001df2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001df4
xor al, al
add rsp, 0x28
ret
Function at 0x180002d40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rcx, qword [0x18003fb20]
lea r8, str.PlayerController
mov rax, qword [0x18003fcd0]
lea rdx, [0x180034862]
mov rcx, qword [rcx]
call rax
xor edi, edi
mov rsi, rax
mov ebx, edi
nop word [rax + rax]
mov r9, qword [0x18003fcb0]
lea rdx, str.Update
mov r8d, ebx
mov rcx, rsi
call r9
test rax, rax
jne 0x180002da5
inc ebx
cmp ebx, 0x10
jl 0x180002d80
jmp 0x180002da8
mov rdi, rax
mov rbx, qword [rdi]
test rbx, rbx
je 0x180002e11
lea rdx, [0x180002870]
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x20]
mov qword [rsp + 0x30], rdx
mov rcx, rbx
call fcn.18002fcd0
mov rdx, qword [0x18003f448]
cmp rdx, qword [0x18003f450]
je 0x180002dfb
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
add qword [0x18003f448], 0x18
jmp 0x180002e05
lea r8, [rsp + 0x20]
call fcn.180002e30
mov rcx, rbx
call fcn.180030010
test eax, eax
je 0x180002e1a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180004be0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180004c3d
lea rbx, [0x180034c80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180004c24
cmp r10, 2
jb 0x180004c24
cmp byte [r9], r8b
jne 0x180004c24
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180004c00
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180004c7f
lea rbx, [0x180034c80]
cmp r8b, 0x23
jne 0x180004c63
cmp byte [r9], r8b
jne 0x180004c63
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180004c50
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180004e60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180004e7a
mov qword [r8], 0
lea rdx, [0x180034ae0]
call fcn.180004c90
mov rbx, rax
test rax, rax
jne 0x180004e9a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180004f73
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004f73
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180004f73
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004f73
cmp rdi, 0xffffffffffffffff
je 0x180004f73
mov rax, qword [0x18003fb40]
test rax, rax
je 0x180004f10
inc dword [rax + 0x3bc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180004f73
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180004f60
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18003fb40]
test rax, rax
je 0x180004f55
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180004f7c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180004f6e
mov qword [r14], rdi
mov rax, rsi
jmp 0x180004f7e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret