joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800159e8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x1c0
mov rbp, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
mov cx, 0x201
xor ebx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x180015aee
lea r8d, [rbx + 0x10]
xor edx, edx
mov rcx, rbp
call sub.ntdll.dll_memset
mov rcx, rdi
mov word [rbp], 2
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x180029648]
lea r12d, [rbx + 1]
lea r8d, [r12 + rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rsi, rax
je 0x180015ae8
mov rdx, rdi
mov rcx, rax
call sub.ntdll.dll_strcpy
mov dx, 0x3a
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, rbx
mov rdi, rax
jne 0x180015a88
mov rdi, rsi
jmp 0x180015a8d
mov byte [rax], bl
add rdi, r12
cmp rdi, rbx
je 0x180015aa7
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 2], ax
cmp rdi, rsi
je 0x180015acb
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
cmp rax, rbx
je 0x180015ad6
mov rax, qword [rax + 0x18]
mov ebx, r12d
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rbp + 4], eax
jmp 0x180015ad6
cmp word [rbp + 2], bx
mov dword [rbp + 4], ebx
cmovne ebx, r12d
mov rcx, qword [0x180029648]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1c0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x1800161a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebp, ebp
mov r13, r8
cmp word [rax + rcx + 4], 0x8664
mov rbx, rcx
jne 0x1800161de
mov eax, dword [rax + rcx + 0x88]
jmp 0x1800161e2
mov eax, dword [rax + rcx + 0x78]
add rax, rcx
test rax, rax
je 0x180016254
cmp dword [rax + 0x1c], ebp
je 0x180016254
cmp dword [rax + 0x20], ebp
je 0x180016254
mov r14d, dword [rax + 0x1c]
mov edi, dword [rax + 0x20]
mov esi, dword [rax + 0x24]
mov r15d, dword [rax + 0x18]
add r14, rcx
add rdi, rcx
add rsi, rcx
xor r12d, r12d
test r15d, r15d
je 0x18001624f
mov ecx, dword [rdi]
add rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18001623a
mov rdx, qword [rsp + 0x58]
add r12d, 1
add rdi, 4
add rsi, 2
cmp r12d, r15d
jb 0x180016213
jmp 0x18001624f
test r13, r13
movzx eax, word [rsi]
lea rbp, [r14 + rax*4]
je 0x18001624f
mov ecx, dword [rdi]
add rcx, rbx
mov qword [r13], rcx
mov rax, rbp
jmp 0x180016256
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180016650
Capabilities:
Capture screenshot

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x70
mov r14, r9
mov r13, r8
mov rbx, rcx
or ebp, 0xffffffff
call qword [sym.imp.USER32.dll_GetWindowDC]
test rax, rax
mov rsi, rax
je 0x1800167c1
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x1800167c1
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x58], eax
jge 0x1800167c1
mov eax, dword [rsp + 0x64]
cmp dword [rsp + 0x5c], eax
jge 0x1800167c1
mov rcx, rsi
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
test rax, rax
mov rdi, rax
je 0x1800167c1
mov r8d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x60]
mov rcx, rsi
sub r8d, dword [rsp + 0x5c]
sub edx, dword [rsp + 0x58]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test rax, rax
mov rbx, rax
je 0x180016769
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
test rax, rax
mov r12, rax
je 0x180016760
mov eax, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
sub eax, dword [rsp + 0x5c]
and dword [rsp + 0x30], 0
sub r9d, dword [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x180016760
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
test rax, rax
mov rsi, rax
je 0x180016760
xor ebp, ebp
jmp 0x180016773
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteDC]
test ebp, ebp
jne 0x1800167c1
and qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rsi
call sub.gdiplus.dll_GdipCreateBitmapFromHBITMAP
test r13, r13
mov rdi, qword [rsp + 0x50]
je 0x1800167b0
xor r9d, r9d
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.gdiplus.dll_GdipSaveImageToStream
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call sub.gdiplus.dll_GdipDisposeImage
lea r11, [rsp + 0x70]
mov eax, ebp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1800167ec
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea rcx, [0x18002c84e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx ecx, word [rdx + 0x14]
lea r8, [rcx + rdx + 0x18]
movzx ecx, word [rdx + 6]
test ecx, ecx
je 0x180016831
bt dword [r8 + 0x24], 0x1f
jb 0x180016834
add r8, 0x28
add ecx, 0xffffffff
jne 0x180016820
xor r8d, r8d
xor edi, edi
test r8, r8
je 0x1800168fc
mov ebx, dword [r8 + 0xc]
xor ecx, ecx
add rbx, rax
mov eax, dword [r8 + 8]
mov dword [rsp + 0x50], ecx
lea rsi, [rax + rbx - 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rax, [0x1800167e4]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmp rbx, rsi
ja 0x1800168fc
mov rax, qword [rbx]
cmp rax, rbx
jne 0x1800168f4
cmp rax, qword [rbx + 8]
jne 0x1800168f4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 8], rcx
lea rax, [rsp + 0x20]
lea rcx, [0x18002cac2]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1800168d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
cmovne rdi, rbx
add rbx, 0x10
test ecx, ecx
je 0x180016890
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, rdi
add rsp, 0x40
pop rdi
ret

Function at 0x180016910
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x180016971
lea rcx, [0x18002c84e]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x18002cedf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800169df
lea rdx, [0x1800142d8]
mov r9, rdi
mov r8, rsi
xor ecx, ecx
call rax
test eax, eax
jne 0x1800169df
jmp 0x1800169d6
cmp qword [0x180029928], 0
jne 0x18001698c
call fcn.1800167ec
test rax, rax
mov qword [0x180029928], rax
je 0x1800169df
mov rcx, qword [0x180029648]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1800169da
mov rdx, qword [0x180029928]
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [rax + 0x18], rsi
lea rcx, [0x1800142d8]
mov qword [rax + 0x10], rcx
mov qword [rdi], rax
mov rcx, qword [rdx + 8]
mov qword [rax + 8], rcx
mov qword [rax], rdx
mov qword [rcx], rax
mov qword [rdx + 8], rax
xor ebx, ebx
jmp 0x1800169df
mov ebx, 8
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18001733c
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and dword [rax + 0x20], 0
mov rsi, rcx
mov rcx, qword [0x180029648]
mov rbp, rdx
mov edi, 8
xor edx, edx
lea r8d, [rdi + 0x49]
mov dword [rax - 0x20], 1
mov dword [rax - 0x1c], 0x2710
mov dword [rax - 0x18], 0x3e8
mov dword [rax - 0x28], 0x493e0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x1800174bb
lea r8d, [rdi + 0x49]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
or rax, 0xffffffffffffffff
lea r9d, [rdi + 4]
lea r8, [rsp + 0x58]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov edx, 0x98000004
mov rcx, rbp
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x18], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1800174b3
cmp dword [rsi + 0x54], eax
je 0x180017430
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1800174b3
mov rdx, rbp
mov rcx, rbx
call qword [rsi + 0x40]
test eax, eax
mov edi, eax
jne 0x1800174b3
lea rcx, [rsi + 0x10]
mov qword [rbx + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
lea rcx, [rsi + 0x10]
mov qword [rsi + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r8d, [rdi + 0x10]
lea rcx, [0x180016f10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x1800174ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi + 0x10]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov r11, qword [rbx]
lea rcx, [rsi + 0x10]
mov qword [rax], r11
mov qword [r11 + 8], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1800174af
xor edi, edi
test edi, edi
je 0x1800174bb
mov rcx, rbx
call fcn.180016eac
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180017724
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x180017789
cmp eax, 0xffffffff
jne 0x18001777c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x18001778e
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x180017783
sub edi, eax
cdqe
add rsi, rax
test edi, edi
je 0x18001778e
jmp 0x180017743
mov ebx, 0x4d4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800177a8
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
xor esi, esi
test r9, r9
mov r12, r9
mov rbp, r8
mov r13, rdx
jne 0x1800177db
lea edi, [rsi + 0x57]
jmp 0x18001793d
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edi, eax
jne 0x180017912
mov rcx, qword [0x180029648]
mov edi, 0x8c
xor edx, edx
mov r8, rdi
lea esi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x18001781e
lea edi, [rsi + 7]
jmp 0x18001792f
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
lea rcx, [rbx + 0x50]
mov r8d, 0x10
mov rdx, r13
call sub.ntdll.dll_memcpy
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or qword [rbx + 0x60], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0x68], rax
je 0x18001791f
test rbp, rbp
mov qword [rbx + 0x70], rbp
jne 0x180017897
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x70], rax
je 0x18001791f
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrDupA]
mov r8d, 6
mov edx, esi
mov qword [rbx + 0x38], rax
lea rax, [fcn.180016cbc]
lea ecx, [r8 - 4]
mov qword [rbx + 0x40], rax
lea rax, [0x180016d04]
mov qword [rbx + 0x48], rax
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x60], rax
je 0x18001791f
lea rax, [rbx + 0x88]
lea r8, [0x1800174d4]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x80], rax
je 0x18001791f
mov qword [0x180029658], rbx
xor edi, edi
jmp 0x18001791a
mov rbx, qword [rsp + 0x208]
cmp edi, 0xffffffff
jne 0x180017927
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x18001793d
test esi, esi
je 0x18001793d
mov rcx, rbx
call fcn.18001795c
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x180017ee4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x180017f2a
test rdx, rdx
je 0x180017f2a
test ebx, ebx
je 0x180017f2a
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180017f1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180017f2f
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1d
jmp 0x180017f2f
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x180017f38
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x180017f7e
test rdx, rdx
je 0x180017f7e
test ebx, ebx
je 0x180017f7e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180017f6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180017f83
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1e
jmp 0x180017f83
mov eax, 0x57
add rsp, 0x30
pop rbx
ret

Function at 0x180018148
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rdx, rdx
mov r10, rdx
mov r9d, ecx
jne 0x180018156
xor eax, eax
ret
test r8, r8
not r9d
je 0x18001819c
lea r11, [0x1800236c0]
movzx edx, byte [r10]
mov eax, r9d
shr r9d, 4
xor al, dl
shr rdx, 4
add r10, 1
and eax, 0xf
mov ecx, dword [r11 + rax*4]
xor ecx, r9d
mov eax, ecx
shr ecx, 4
and eax, 0xf
xor rax, rdx
mov r9d, dword [r11 + rax*4]
xor r9d, ecx
sub r8, 1
jne 0x180018165
not r9d
mov eax, r9d
ret
Function at 0x18001c474
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x90
mov rdi, r8
mov rsi, rcx
mov rbx, rdx
xor ebp, ebp
lea rcx, [rax - 0x68]
xor edx, edx
lea r8d, [rbp + 0x60]
call sub.ntdll.dll_memset
test rsi, rsi
je 0x18001c4bd
test rbx, rbx
je 0x18001c4bd
test rdi, rdi
je 0x18001c4bd
mov al, byte [rbx]
mov rcx, rbx
cmp al, 0x2f
jne 0x18001c4e6
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp al, 0x5c
je 0x18001c4bd
cmp al, 0x3a
je 0x18001c4bd
add rcx, 1
mov al, byte [rcx]
test al, al
jne 0x18001c4d8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
cmp eax, 0xffffffff
je 0x18001c52c
mov r8d, 0x809
call fcn.18001b1f4
mov rdx, rsi
lea rcx, [rsp + 0x30]
test eax, eax
je 0x18001c52c
call fcn.18001b654
test eax, eax
jne 0x18001c53d
lea rcx, [rsp + 0x30]
call fcn.18001b2c0
jmp 0x18001c4bd
xor r8d, r8d
call fcn.18001b5e0
test eax, eax
je 0x18001c4bd
mov ebp, 1
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 9
and word [rsp + 0x20], 0
call fcn.18001bcb4
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.18001c1f4
lea rcx, [rsp + 0x30]
neg eax
sbb edi, edi
and edi, ebx
call fcn.18001c360
neg eax
sbb ebx, ebx
and ebx, edi
jne 0x18001c599
test ebp, ebp
je 0x18001c599
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001c599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x18001c4bf
Function at 0x18001d7e4
Capabilities:
Hash data with crc32

Disassembly:
or r11d, 0xffffffff
mov r8d, r11d
jmp 0x18001d81b
movsx r9d, byte [rcx]
add edx, r11d
mov r10d, 8
add rcx, 1
mov eax, r9d
xor eax, r8d
shr r8d, 1
test al, 1
je 0x18001d812
xor r8d, 0xedb88320
shr r9d, 1
sub r10, 1
jne 0x18001d7fe
test edx, edx
jne 0x18001d7ed
mov eax, r8d
ret
Function at 0x140020820
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x1400463d0], rdi
jne 0x14002085f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x1400463d0], rcx
je 0x14002085f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400463d0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx - 0x10]
lea rax, [rbx - 0x10]
sub qword [0x1400463e8], rcx
mov r9, rax
sub r9, qword [rax + 8]
cmp qword [r9], rdi
jne 0x14002089e
add qword [r9 + 0x20], rcx
lea r8, [r9 + 0x20]
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
jmp 0x1400208c9
lea r8, [rax + 0x20]
mov r9, rax
mov qword [r8], rcx
mov rcx, qword [0x1400463e0]
mov qword [rax], rdi
mov qword [rbx], rcx
mov qword [rax + 0x18], rdi
test rcx, rcx
je 0x1400208c2
mov qword [rcx + 0x18], rax
mov qword [0x1400463e0], rax
mov rcx, qword [r8]
cmp qword [rcx + r9], rdi
lea rdx, [rcx + r9]
jne 0x140020914
add rcx, qword [rdx + 0x20]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x1400208f2
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x140020901
mov qword [rax + 0x10], rcx
jmp 0x140020908
mov qword [0x1400463e0], rcx
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
lea rdx, [rax + r9]
cmp qword [r9 + 8], rdi
jne 0x140020980
cmp qword [rdx], 1
jne 0x140020980
mov rax, qword [0x1400463e8]
mov rdx, qword [0x1400463f0]
sub rdx, qword [r8]
lea rcx, [rax + rax*2]
shr rcx, 1
cmp rdx, rcx
jbe 0x140020980
mov rcx, qword [r9 + 0x10]
mov qword [0x1400463f0], rdx
test rcx, rcx
je 0x140020959
mov rax, qword [r9 + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140020968
mov qword [rax + 0x10], rcx
jmp 0x14002096f
mov qword [0x1400463e0], rcx
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x1400463d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x3b35adf
insb byte [rdi], dx
mov al, byte [rax + 0x67fe75d4]
jnp 0x140069edb
invalid
invalid
nop
jmp 0x140069f35
ror ah, cl
pop rdi
pop rdx
and al, 0x1d
sti
pop rbp
scasb al, byte [rdi]
push rax
out dx, al
shl ebp, 0x3a
cmp cl, byte [rsi]
cli
call 0x19be13304
out dx, eax
adc bl, bl
xchg esi, eax
invalid
neg dword [rdi]
add bl, byte [rbx]
sub eax, 0xfe0e62f3
jnp 0x140069ebe
jno 0x140069eed
jbe 0x140069e9b
lea edi, [rsi]
hlt
scasq rax, qword [rdi]
invalid
xor byte [rcx], bl
out 0xa8, al
ror dword [rdi - 0x1f290e80], 0x85
jo 0x140069efb
cdq
xchg ebp, eax
lahf
invalid
sub eax, 0x767f0e08
sub ch, byte [rbp + 0x68]
sbb edx, ebx
invalid
invalid
jbe 0x14006a3e6
sub ebp, ebp
mov al, 0x19
invalid
mov byte [rdx - 0x1a29a63c], ah
sbb ebx, dword [rdi + rdi*2 + 0x737bf0c5]
stosd dword [rdi], eax
cld
mov byte [rsi + 0x59], bl
invalid
invalid
add eax, 0x7c3a54b1
push rdx
jmp [rdi - 0x10]
Function at 0x140003330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x70
mov rbp, qword [0x140170080]
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
mov r14, rbp
movaps xmmword [rsp + 0x50], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm2
lea rax, [rbp + 8]
cmp rax, rcx
je 0x140003387
mov r8d, 0x594
lea rdx, str.C:Usershabib_ahammedDesktopmain_projectmain_projectInnormal_cHEATS_pas__112233445566Streetfffffffffimgui.cpp
lea rcx, str.g.IO__this___Can_only_add_events_to_current_context._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbp, qword [0x140170080]
cmp byte [rbx + 0x37a1], 0
je 0x140003531
movss xmm1, dword [0x14014eb0c]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
jbe 0x1400033d4
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x1400033cd
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x1400033cb
je 0x1400033cd
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x1400033f9
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x1400033f2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x1400033f0
je 0x1400033f2
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov esi, dword [rbp + 0x37c0]
sub esi, 1
movsxd rdi, esi
js 0x14000344f
lea rbx, [rdi + rdi*2]
shl rbx, 3
nop
cmp esi, dword [rbp + 0x37c0]
jl 0x140003432
mov r8d, 0x6ff
lea rdx, str.C:Usershabib_ahammedDesktopmain_projectmain_projectInnormal_cHEATS_pas__112233445566Streetfffffffffimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbp + 0x37c8]
cmp dword [rbx + rax], 1
je 0x1400034d9
dec esi
sub rbx, 0x18
sub rdi, 1
jns 0x140003410
movsd xmm0, qword [r14 + 0xdfc]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x14000348e
jne 0x14000348e
ucomiss xmm1, xmm7
jp 0x14000348e
je 0x140003531
lea rbx, [r14 + 0x37c0]
movss dword [rsp + 0x38], xmm6
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
movss dword [rsp + 0x3c], xmm7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
cmp ecx, r8d
jne 0x14000350f
inc ecx
test r8d, r8d
je 0x1400034fb
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140003500
movss xmm0, dword [rbx + rax + 8]
movss xmm1, dword [rbx + rax + 0xc]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x140003463
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001f7b0
movsxd rax, dword [rbx]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
ret