joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005950d
Capabilities:
Connect socket
Set socket configuration

Disassembly:
jmp 0x14009f760
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14013d040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1401531ff]
call fcn.14005a214
nop
mov rax, qword [rbp + 0x150]
mov rcx, qword [rax]
call fcn.140057b1d
movzx eax, al
mov dl, 1
mov rcx, qword [rbp + 0x158]
call fcn.140059a08
nop
mov rax, qword [rbp + 0x160]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x160]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x14009f871
call fcn.1400588f6
movzx eax, al
test eax, eax
je 0x14009f825
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 8]
mov dword [rax], 2
xor al, al
jmp 0x14009f95f
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0x150]
mov rcx, qword [rcx + 0x10]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, qword [rbp + 0x158]
call fcn.14005a2a5
mov rcx, qword [rbp + 0x150]
mov rcx, qword [rcx + 8]
mov dword [rcx], eax
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 8]
cmp dword [rax], 0
je 0x14009f871
xor al, al
jmp 0x14009f95f
xor edx, edx
mov rcx, qword [rbp + 0x158]
call fcn.140059a08
nop
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 0x20]
imul rax, qword [rax], 0x3e8
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x150]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
cqo
mov ecx, 0x3e8
idiv rcx
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov dword [rbp + 0x24], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x24]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 0x30]
imul rax, qword [rax], 0x3e8
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x150]
mov rcx, qword [rcx + 0x38]
mov rax, qword [rcx]
cqo
mov ecx, 0x3e8
idiv rcx
mov rcx, qword [rbp + 0x118]
add rcx, rax
mov rax, rcx
mov dword [rbp + 0x44], eax
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x44]
mov r8d, 0x1005
mov edx, 0xffff
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
mov rax, qword [rbp + 0x150]
mov rax, qword [rax + 8]
mov dword [rax], 0
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140117840]
call fcn.14005995e
mov rax, rdi
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.140058824
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x14005a45d
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x14009fe50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1401531ff]
call fcn.14005a214
nop
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_send]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret

Function at 0x140101430
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14005a430
movzx eax, al
test eax, eax
jne 0x140101450
mov ecx, 7
call fcn.1400599ae
nop
mov byte [rsp + 0x20], 0
call fcn.140059a94
mov byte [rsp + 0x21], al
cmp dword [0x140140f38], 1
jne 0x140101474
mov ecx, 7
call fcn.1400599ae
nop
jmp 0x1401014cc
cmp dword [0x140140f38], 0
jne 0x1401014c7
mov dword [0x140140f38], 1
lea rdx, [0x140112890]
lea rcx, [0x140112560]
call fcn.1400587a7
test eax, eax
je 0x1401014a8
mov eax, 0xff
jmp 0x1401015d1
lea rdx, [0x140112450]
lea rcx, [section..rdata]
call fcn.140059a53
mov dword [0x140140f38], 2
jmp 0x1401014cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140059922
call fcn.1400593fa
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140101529
mov rcx, qword [rsp + 0x30]
call fcn.1400582e3
movzx eax, al
test eax, eax
je 0x140101529
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140155020]
nop
call fcn.14005962a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14010155d
mov rcx, qword [rsp + 0x38]
call fcn.1400582e3
movzx eax, al
test eax, eax
je 0x14010155d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14005a0ac
nop
call fcn.140101640
mov dword [rsp + 0x28], eax
call fcn.1400592a1
movzx eax, al
test eax, eax
jne 0x14010157c
mov ecx, dword [rsp + 0x28]
call fcn.140057348
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14010158b
call fcn.14005a129
nop
xor edx, edx
mov cl, 1
call fcn.1400581f3
mov eax, dword [rsp + 0x28]
jmp 0x1401015d1
add rsp, 0x68
ret
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x00406a0b]
mov r11, rax
lea rax, str.output.exe
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x401058
lea rax, str.Failed_to_open_file
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x4010f4
mov rax, qword [rbp - 8]
mov r9, rax
movabs rax, 0x4a00
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, section..data
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0x4a00
je 0x4010ce
lea rax, str.Failed_to_write_data_to_file
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
mov eax, 1
jmp 0x4010f4
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
lea rax, str.Binary_data_written_to_output.exe_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret

Function at 0x40100b
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [0x00406a0b]
mov r11, rax
lea rax, str.output.exe
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x401058
lea rax, str.Failed_to_open_file
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov eax, 1
jmp 0x4010f4
mov rax, qword [rbp - 8]
mov r9, rax
movabs rax, 0x4a00
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, section..data
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0x4a00
je 0x4010ce
lea rax, str.Failed_to_write_data_to_file
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_perror
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
mov eax, 1
jmp 0x4010f4
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
lea rax, str.Binary_data_written_to_output.exe_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret
Function at 0x180005e42
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov eax, dword [0x180018a68]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x180018a64], 0xa
setl cl
test cl, al
jne 0x180005e87
xor cl, al
je 0x180005f0f
mov eax, 0x20
call fcn.1800151d0
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.1800151d0
sub rsp, rax
mov r12, rsp
sub rsp, 0x20
mov ecx, 0x64
call fcn.18000d227
add rsp, 0x20
mov r13, rax
sub rsp, 0x20
mov ecx, 0x1000
call fcn.18000d227
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
mov rcx, rsi
mov rdx, r13
mov r8, rax
call fcn.1800059e6
add rsp, 0x20
mov ecx, dword [0x180018a68]
lea edx, [rcx - 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
test ecx, edx
sete cl
cmp dword [0x180018a64], 0xa
setl dl
test dl, cl
jne 0x180005f49
xor dl, cl
jne 0x180005f49
sub rsp, 0x20
mov ecx, 0x64
call fcn.18000d227
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
mov ecx, 0x1000
call fcn.18000d227
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.1800059e6
add rsp, 0x20
jmp 0x180005e87
test al, al
je 0x180006003
xor eax, eax
mov byte [rdi], al
mov rdx, rdi
add rdx, 4
mov dword [rdi + 4], 0x6f0a8e1f
mov dword [rdi + 8], 0x6f0e8e2f
mov dword [rdi + 0xc], 0x6f4b8e61
mov dword [rdi + 0x10], 0x6f6b8e5b
cmp byte [rdi], al
jne 0x180005fa7
xor eax, eax
mov ecx, dword [rdi + rax*4 + 4]
mov esi, ecx
not esi
and esi, 0x4ac6496
and ecx, 0xfb539b69
or ecx, esi
xor ecx, 0x6bc7eacd
mov dword [rdi + rax*4 + 4], ecx
inc rax
cmp rax, 4
jne 0x180005f7e
sub rsp, 0x20
mov rcx, r15
mov r8d, 0xc
call fcn.18000ce55
add rsp, 0x20
add r15, 0xc
sub rsp, 0x20
mov rcx, r13
mov rdx, r15
call fcn.18000bc9c
add rsp, 0x20
mov byte [r12], 0
mov eax, dword [0x180018958]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x180018954], 0xa
setl cl
test cl, al
jne 0x18000600a
xor cl, al
jne 0x18000600a
jmp 0x180006001
xor esi, esi
jmp 0x1800060de
mov dword [r12 + 4], 0x7e21f81d
mov dword [r12 + 8], 0x7e25f831
mov dword [r12 + 0xc], 0x7e2bf837
mov dword [r12 + 0x10], 0x7e6ef864
mov dword [r12 + 0x14], 0x7e4ef85e
mov eax, dword [0x1800188f8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete cl
cmp dword [0x1800188f4], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
cmp al, 1
jne 0x180006070
mov cl, byte [r12]
test al, al
jne 0x180006076
mov cl, byte [r12]
jmp 0x180006068
mov rdx, r12
add rdx, 4
test cl, cl
jne 0x1800060ae
mov eax, 1
xor ecx, ecx
mov edi, dword [r12 + rax*4]
mov esi, edi
not esi
and esi, 0x7e4ef85e
and edi, 0x81b107a1
or edi, esi
mov dword [r12 + rax*4], edi
inc rcx
inc rax
cmp rax, 6
jne 0x180006088
sub rsp, 0x20
mov rcx, r14
mov r8d, 0x10
call fcn.18000ce55
add rsp, 0x20
add r14, 0x10
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.18000bc9c
add rsp, 0x20
mov sil, 1
sub rsp, 0x20
mov rcx, r13
call fcn.18000d001
mov rcx, rbx
call fcn.18000d001
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180009c7a
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
xor eax, eax
mov dword [rcx + 0x250], eax
mov qword [rcx + 0x248], 1
mov dword [rcx + 8], eax
mov ecx, 0x36
call fcn.18000d227
mov r14, rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x2c], 0x25aa52c7
mov dword [rsp + 0x30], 0x36b34dc7
mov eax, 0x31b6448b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0x29b54185
mov dword [rsp + 0x3c], 0x2fa90add
mov dword [rsp + 0x40], 0x33b144dc
mov dword [rsp + 0x44], 0x25be48c9
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], 0x2eb04585
mov dword [rsp + 0x50], 0x2cf44fc6
mov dword [rsp + 0x54], 0x34ba5ed6
mov dword [rsp + 0x58], 0x3bb64bca
mov dword [rsp + 0x5c], 0x33ba09dc
mov dword [rsp + 0x60], 0x5cd927c8
mov eax, dword [0x1800188c0]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete cl
cmp dword [0x1800188bc], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
cmp al, 1
jne 0x180009d54
mov cl, byte [rsp + 0x28]
test al, al
jne 0x180009d5a
mov cl, byte [rsp + 0x28]
jmp 0x180009d4c
lea rdx, [rsp + 0x2c]
test cl, cl
jne 0x180009d96
mov eax, 1
xor ecx, ecx
mov ebx, dword [rsp + rax*4 + 0x28]
mov edi, ebx
not edi
and edi, 0x1ca215da
and ebx, 0xe35dea25
or ebx, edi
xor ebx, 0x407b327f
mov dword [rsp + rax*4 + 0x28], ebx
inc rcx
inc rax
cmp rax, 0xf
jne 0x180009d6a
mov rcx, r14
mov r8d, 0x36
call fcn.18000ce55
lea r8, [rsi + 0x220]
lea rdx, [rsi + 0x218]
mov rcx, r14
call fcn.180009bcd
mov rcx, r14
call fcn.18000d001
mov ecx, 0xa
call fcn.18000d227
mov r14, rax
xor eax, eax
mov byte [rsp + 0x28], al
mov dword [rsp + 0x2c], 0x51caaeca
mov dword [rsp + 0x30], 0x46dcb7d6
mov dword [rsp + 0x34], 0x34b9c1d7
cmp byte [rsp + 0x28], al
jne 0x180009e52
mov eax, dword [0x1800188b8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
cmp dword [0x1800188b4], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
mov ecx, 1
xor edx, edx
mov edi, dword [rsp + rcx*4 + 0x28]
test al, al
je 0x180009e99
mov ebx, edi
not ebx
and ebx, 0x7ea17f5c
and edi, 0x815e80a3
or edi, ebx
xor edi, 0x4a18bef8
mov dword [rsp + rcx*4 + 0x28], edi
inc rdx
inc rcx
cmp rcx, 4
jne 0x180009e22
lea rdx, [rsp + 0x2c]
mov rcx, r14
mov r8d, 0xa
call fcn.18000ce55
lea r8, [rsi + 0x230]
lea rdx, [rsi + 0x228]
mov rcx, r14
call fcn.180009bcd
mov rcx, r14
call fcn.18000d001
mov dword [rsi + 0x238], 0
mov al, 1
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
jmp 0x180009e99
Function at 0x18000add0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.180007f38
test ebp, ebp
je 0x18000ae3f
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x54], 0x3d639140
mov dword [rsp + 0x58], 0x3d63cb42
mov dword [rsp + 0x5c], 0x5107e542
mov eax, dword [0x1800188b0]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
cmp dword [0x1800188ac], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
cmp al, 1
je 0x18000af06
jmp 0x18000af0e
mov ecx, 0x68
call fcn.18000d227
mov rdi, rax
mov ecx, 8
call fcn.18000d227
mov rsi, rax
mov dword [rdi], 0x68
mov dword [rdi + 0x3c], 1
mov word [rdi + 0x40], 0
xor ecx, ecx
mov edx, 1
mov r8d, 0x2bf91925
mov r9d, 0x3c
call fcn.18000e5ac
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rax
test rax, rax
je 0x18000b003
mov rdi, qword [rsi + 8]
xor ecx, ecx
mov edx, 1
mov r8d, 0x2db58ff7
mov r9d, 0x11
call fcn.18000e5ac
mov rcx, rdi
call rax
mov rsi, qword [rsi]
xor ecx, ecx
mov edx, 1
mov r8d, 0x2db58ff7
mov r9d, 0x11
call fcn.18000e5ac
mov rcx, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
jmp rax
mov dl, byte [rsp + 0x50]
test al, al
jne 0x18000af14
mov cl, byte [rsp + 0x50]
jmp 0x18000af06
lea rcx, [rsp + 0x54]
test dl, dl
jne 0x18000af4a
mov eax, 1
xor edx, edx
mov ebp, dword [rsp + rax*4 + 0x50]
mov ebx, ebp
not ebx
and ebx, 0x5107e52e
and ebp, 0xaef81ad1
or ebp, ebx
mov dword [rsp + rax*4 + 0x50], ebp
inc rdx
inc rax
cmp rax, 4
jne 0x18000af24
xor edx, edx
call fcn.18000122a
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x54], 0x33254a68
mov dword [rsp + 0x58], 0x6f644366
mov dword [rsp + 0x5c], 0x313b4b2d
mov dword [rsp + 0x60], 0x5d572f03
mov eax, dword [0x1800188a8]
mov ecx, dword [0x1800188a4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
setne dl
sete bl
cmp ecx, 9
setg al
cmp ecx, 0xa
setl cl
xor cl, bl
or al, dl
mov dl, 1
xor al, dl
or al, cl
cmp al, dl
jne 0x18000afb7
mov dl, byte [rsp + 0x50]
test al, al
jne 0x18000afbd
mov cl, byte [rsp + 0x50]
jmp 0x18000afaf
lea rcx, [rsp + 0x54]
test dl, dl
jne 0x18000aff1
xor eax, eax
mov edx, dword [rsp + rax*4 + 0x54]
mov ebp, edx
not ebp
and ebp, 0x6f577c43
and edx, 0x90a883bc
or edx, ebp
xor edx, 0x32005340
mov dword [rsp + rax*4 + 0x54], edx
inc rax
cmp rax, 4
jne 0x18000afc8
xor edx, edx
call fcn.18000122a
mov rcx, rdi
mov rdx, rsi
call fcn.180012481
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x18000dec5
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, qword [0x1800173b0]
test r14, r14
je 0x18000dee7
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov eax, dword [0x180018a50]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete al
cmp dword [0x180018a4c], 0xa
setl bl
mov ecx, ebx
and cl, al
xor bl, al
or bl, cl
xor r14d, r14d
mov rdi, rsi
test bl, bl
je 0x18000df61
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x18000deda
movzx edx, word [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
mov r8b, 1
mov r9b, 1
call fcn.18000dcb0
cmp eax, 0x148403b0
jne 0x18000df2b
mov r14, qword [rdi + 0x30]
mov qword [0x1800173b0], r14
jmp 0x18000deda
jmp 0x18000df61
Function at 0x18000e5ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x180018a28]
mov r11d, dword [0x180018a24]
lea esi, [rax - 1]
imul esi, eax
mov eax, 0xffffffff
xor esi, eax
or esi, 0xfffffffe
cmp esi, eax
sete sil
setne r10b
cmp r11d, 0xa
setl bl
cmp r11d, 9
setg al
cmp bl, sil
jne 0x18000e5f5
or al, r10b
xor al, 1
jne 0x18000e5f5
jmp 0x18000e5f3
lea eax, [r9 - 1]
cmp eax, 0x225
ja 0x18000e635
mov rax, qword [0x1800173a8]
test rax, rax
je 0x18000e635
mov bl, 1
test bl, bl
je 0x18000e635
mov esi, r9d
mov rax, qword [rax + rsi*8]
test rax, rax
jne 0x18000e62e
call fcn.18000e183
mov rcx, qword [0x1800173a8]
mov qword [rcx + rsi*8], rax
add rsp, 0x28
pop rbx
pop rsi
ret
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.18000e183
Function at 0x18000f5d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.18000e640
xor ecx, ecx
mov edx, 1
mov r8d, 0x26ac9c78
mov r9d, 0x70
call fcn.18000e5ac
call rax
mov ecx, eax
call fcn.18000c343
mov ecx, 0x930
call fcn.18000d227
mov rsi, rax
mov rcx, rax
mov edx, 0x10
call fcn.18000b00d
mov ecx, dword [rsi + 0x3c4]
cmp ecx, 9
jae 0x18000f635
mov eax, 0x113
shr eax, cl
mov ecx, eax
xor ecx, 0x1fe
test cx, ax
jne 0x18000f664
mov eax, dword [0x180018b50]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x180018b4c], 0xa
setl cl
mov edi, 0x3e8
test cl, al
jne 0x18000f669
xor cl, al
jne 0x18000f669
jmp 0x18000f662
mov edi, 0x7530
xor ecx, ecx
mov edx, 1
mov r8d, 0x9d3c7b7a
mov r9d, 0xb2
call fcn.18000e5ac
mov ecx, edi
xor edx, edx
call rax
mov rcx, rsi
mov edx, 0x20
call fcn.18000b00d
lea rdx, [rsi + 0x928]
mov rcx, rsi
add rcx, 0x8fc
call fcn.18000804c
test al, al
je 0x18000f747
mov eax, dword [0x180018b38]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete al
cmp dword [0x180018b34], 0xa
setl cl
test cl, al
jne 0x18000f6df
xor cl, al
je 0x18000f726
xor ecx, ecx
mov edx, 1
mov r8d, 0x510b3a3e
mov r9d, 0x5c
call fcn.18000e5ac
mov ecx, 2
call rax
mov eax, dword [0x180018b38]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x180018b34], 0xa
setl cl
test cl, al
jne 0x18000f747
xor cl, al
jne 0x18000f747
xor ecx, ecx
mov edx, 1
mov r8d, 0x510b3a3e
mov r9d, 0x5c
call fcn.18000e5ac
mov ecx, 2
call rax
jmp 0x18000f6df
cmp dword [rsi + 0x3c4], 8
jne 0x18000f762
mov rcx, rsi
xor edx, edx
call fcn.1800094c4
mov rcx, rsi
call fcn.18000ba67
mov rcx, rsi
call fcn.180007f38
xor ecx, ecx
call fcn.18000f77a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000f838
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x18000f890
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x18000f8d3
movzx eax, word [rcx + rax + 4]
cmp eax, 0x8664
jne 0x18000f8d3
mov eax, dword [0x180018b50]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete cl
cmp dword [0x180018b4c], 0xa
setl dl
mov al, 1
test dl, cl
jne 0x18000f8d5
xor dl, cl
jne 0x18000f8d5
jmp 0x18000f88e
mov eax, dword [0x180018b50]
mov edx, dword [0x180018b4c]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, 0xffffffff
xor ecx, eax
or ecx, 0xfffffffe
cmp ecx, eax
sete r9b
setne r8b
cmp edx, 0xa
setl cl
cmp edx, 9
setg dl
xor eax, eax
cmp cl, r9b
jne 0x18000f8d5
or dl, r8b
xor dl, 1
jne 0x18000f8d5
jmp 0x18000f8d1
xor eax, eax
ret
Function at 0x140002150
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400021d9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400021d9
nop dword [rax]
lea rdx, str.DungeonCrawler.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x1400021fd
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400021b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140002450
add rsp, 0x270
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400021e4
Function at 0x140002210
Capabilities:
Acquire debug privileges
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.140002150
lea rcx, str.Waiting_for_Dark_and_Darker..._n
call fcn.140001010
nop dword [rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002150
mov ebx, eax
test eax, eax
je 0x140002240
xorps xmm0, xmm0
xor edi, edi
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400022d4
lea r8, [rsp + 0x64]
mov dword [rsp + 0x60], 1
lea rdx, str.SeDebugPrivilege
mov dword [rsp + 0x6c], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400022c9
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Open_Process..._n
call fcn.140001010
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140002323
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess_failed:_0x_X_n
call fcn.140001010
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xfffffffe
jmp 0x140002418
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x5c], edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x14000234f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.140001010
jmp 0x140002371
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x5c], eax
je 0x14000239a
lea rcx, str.Invalid_Process_Architecture._n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xfffffffd
jmp 0x140002418
lea rcx, str.Inject..._n
call fcn.140001010
mov qword [rsp + 0x40], rdi
lea rdx, [0x140006110]
mov dword [rsp + 0x38], 1
mov r9b, 1
mov byte [rsp + 0x30], 1
xor r8d, r8d
mov byte [rsp + 0x28], 1
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.140001070
mov rcx, rbx
test al, al
jne 0x140002404
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Error_while_injecting._n
call fcn.140001010
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0xfffffff8
jmp 0x140002418
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400047b8]
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140002450
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret