joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004ff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000504d
lea rbx, [0x180042c60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180005034
cmp r10, 2
jb 0x180005034
cmp byte [r9], r8b
jne 0x180005034
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180005010
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000508f
lea rbx, [0x180042c60]
cmp r8b, 0x23
jne 0x180005073
cmp byte [r9], r8b
jne 0x180005073
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180005060
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180005190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1800051ae
mov qword [r8], r14
lea rdx, [0x180271af0]
call fcn.1800050a0
mov rbx, rax
test rax, rax
jne 0x1800051d3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800052ff
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800052ff
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800052ff
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800052ff
cmp rdi, 0xffffffffffffffff
je 0x1800052ff
mov rcx, rdi
call fcn.180008df0
mov rbp, rax
test rax, rax
je 0x1800052ff
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800052ec
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x180283de8]
test r8, r8
je 0x1800052e1
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1800052d6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180005308
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800052fa
mov qword [rsi], rdi
mov rax, rbp
jmp 0x18000530a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800088d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x180042c60]
movsxd rcx, dword [rcx + 0x100]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x108]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x4084], ebx
jne 0x180008964
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.18001cbb0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000c8a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x180283de8]
xor r14d, r14d
mov ebp, edx
mov r10, rcx
mov rbx, qword [rdi + 0x4038]
mov r9d, dword [rdi + 0x49e8]
bts r9d, 8
mov esi, dword [rbx + 0x14]
and esi, 4
mov dword [rdi + 0x49e8], r9d
or esi, 0x1000103
mov dword [rdi + 0x4a20], r14d
cmp qword [rbx + 0x1b8], r14
jne 0x18000c921
mov eax, 0x260
cmp qword [rdi + 0x4dd8], r14
je 0x18000c926
mov eax, 0x230
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x114]
subss xmm2, dword [rbx + 0x110]
mov rdx, qword [r8]
call fcn.1800154c0
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rdi + 0x4a08], xmm0
xor edx, edx
mov dword [rdi + 0x49e8], r9d
mov dword [rdi + 0x49f0], 1
mov r9, qword [rbx + 8]
test r10, r10
je 0x18000c998
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.180004e80
jmp 0x18000c9a8
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.180004e80
movss xmm6, dword [rdi + 0x3920]
mov r8d, esi
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov dword [rdi + 0x3920], r14d
call fcn.18000fa50
mov rsi, qword [rdi + 0x4038]
movzx r14d, al
movss dword [rdi + 0x3920], xmm6
cmp word [rsi + 0xcc], 1
mov dword [rsi + 0x88], ebp
jne 0x18000c9f6
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, ebp
lea rdx, [0x180270fd1]
not r9d
lea r10, [0x180042c60]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x18000ca23
cmp byte [rdx], r8b
jne 0x18000ca23
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18000ca10
not ebx
cmp dword [rdi + 0x409c], ebx
jne 0x18000ca53
xor edx, edx
xor ecx, ecx
call fcn.180008980
cmp dword [rdi + 0x4b18], ebp
jne 0x18000ca98
cmp word [rsi + 0x16c], 0
jne 0x18000ca6e
cmp byte [rsi + 0x172], 0
je 0x18000ca98
xor edx, edx
mov rcx, rsi
call fcn.180012020
xor edx, edx
mov rcx, rsi
call fcn.180017d00
mov rdx, rsi
mov ecx, ebx
call fcn.180008980
mov eax, dword [rdi + 0x4b3c]
mov dword [rdi + 0x40c0], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18003f330
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x18001b490
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fc0], 0
lea rbx, [rcx + 0x5fc8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001b537
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18001b4ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001dc60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180005650
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5fc0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5fd0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180283dc2]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001b53f
mov rcx, rbx
call fcn.180005650
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18001b7a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x180283de8]
xor ebp, ebp
cmp byte [rbx + 0x5f18], bpl
jne 0x18001b87f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18001b878
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.180005190
mov rsi, rax
test rax, rax
je 0x18001b878
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18001b804
mov rcx, rax
call fcn.18001b9d0
mov r8, qword [0x180283de8]
test r8, r8
je 0x18001b86f
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18001b864
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f18], 1
movss xmm0, dword [rbx + 0x5f1c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18001b90e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f1c], xmm0
jb 0x18001b90e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x18001b901
mov rax, qword [0x180283de8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f1c], ebp
call fcn.18001bc30
lea rdx, [0x180271af4]
mov rcx, rdi
mov rsi, rax
call fcn.1800050a0
mov rdi, rax
test rax, rax
je 0x18001b908
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18001b908
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f1c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18001b930
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180283de8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001b993
mov qword [rsp], rbx
lea rbx, [0x180042c60]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001b973
cmp byte [r8], r9b
jne 0x18001b973
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001b960
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f30]
not eax
mov r8, qword [r10 + 0x5f38]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001b9bf
cmp dword [r8 + 8], eax
je 0x18001b9c6
add r8, 0x48
cmp r8, rcx
jne 0x18001b9b0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x180032a50
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x180283de8]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x180032c6e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180032c6e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x180283de8]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x180032b24
movsx rdx, word [r8 + 0x6078]
lea rax, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x180032b19
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rax, [rax*8 + 0x607c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6070]
test rdi, rdi
je 0x180032b41
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x180032b44
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1802721d8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x180032b87
mov rsi, qword [r8 + 0x90]
jmp 0x180032b8a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180032bb5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x180283de8]
mov rcx, qword [rax + 0x4b00]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x180032c2e
inc rbx
cmp rbx, 5
jl 0x180032c10
jmp 0x180032c5a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x180032c70
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18003f330
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18003b320
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
mov ecx, 2
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18003b3b6
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x18003b3a4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x18003b3a4
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18003b380
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003f330
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18003b930
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
mov ecx, 2
mov esi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18003b9e3
nop word [rax + rax]
lea rdx, str.HD_Player.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x18003b9c4
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x18003b9c4
mov esi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18003b9a0
test esi, esi
je 0x18003b9e3
lea rax, str.HD_Player.exe
jmp 0x18003ba61
xor edx, edx
mov ecx, 2
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18003ba61
nop dword [rax]
lea rdx, str.AndroidProcess.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x18003ba44
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x18003ba44
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18003ba20
test edi, edi
je 0x18003ba61
lea rax, str.AndroidProcess.exe
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003f330
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18003ba90
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.18003b930
mov rdx, rax
call fcn.18003bc80
test eax, eax
je 0x18003baec
mov dword [0x180283e30], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x180283e38], rax
test rax, rax
jne 0x18003baff
lea rdx, str.An_unexpected_error_occurred
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18003e9c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x60], 0x64
mov rax, qword [0x180283e10]
sub rax, qword [0x180283e00]
sar rax, 3
cmp rax, 0x64
jae 0x18003bb35
lea rdx, [rsp + 0x60]
call fcn.18003ecf0
mov r9, qword [0x180283e18]
call fcn.18003bd70
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
xor ebp, ebp
mov qword [rsp + 0x78], rbp
mov rax, qword [0x180283e00]
mov rdx, qword [0x180283e08]
cmp rax, rdx
jne 0x18003bb95
mov r8d, 0xe
lea rdx, str.Erro_Disabled_
call fcn.18003e830
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rdx, [0x180042928]
call fcn.18003e830
jmp 0x18003bc4f
sub rdx, rax
sar rdx, 3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x18003eba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, ebp
mov rax, qword [0x180283e08]
mov rdx, qword [0x180283e00]
sub rax, rdx
sar rax, 3
test rax, rax
je 0x18003bc4f
mov rdi, rbp
nop dword [rax + rax]
mov rax, qword [rdi + rdx]
lea rdx, [rax + 0x8c]
lea rbx, [rax + 0x5c]
mov qword [rsp + 0x20], rbp
mov r9d, 4
lea r8, [rsp + 0x60]
mov rcx, qword [0x180283e38]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], rbp
mov r9d, 4
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x180283e38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc esi
lea rdi, [rdi + 8]
mov rcx, qword [0x180283e08]
mov rdx, qword [0x180283e00]
sub rcx, rdx
sar rcx, 3
movsxd rax, esi
cmp rax, rcx
jb 0x18003bbe0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18003f330
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18003bc80
Capabilities:
Enumerate processes

Disassembly:
push rsi
sub rsp, 0x270
mov rax, qword [0x18027a040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
test rdx, rdx
jne 0x18003bcaa
xor eax, eax
jmp 0x18003bd4c
mov qword [rsp + 0x280], rbx
xor edx, edx
mov qword [rsp + 0x290], rbp
mov ecx, 2
mov qword [rsp + 0x298], rdi
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x18003bd32
nop
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x18003bd20
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jbe 0x18003bd20
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18003bd00
mov rbp, qword [rsp + 0x290]
mov eax, edi
mov rdi, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003f330
add rsp, 0x270
pop rsi
ret
Function at 0x18003c0a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x70], rax
lea r14, [0x180283e00]
mov qword [rbp + 0x70], r14
xorps xmm0, xmm0
movdqa xmmword [0x180283e00], xmm0
mov qword [0x180283e10], 0
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x24], 0
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x30], 0x3f3f3f3f
mov dword [rsp + 0x34], 0x3f3f3f3f
mov dword [rsp + 0x38], 0x3f3f3f3f
mov qword [rsp + 0x3c], 0x3f3f3f3f
mov qword [rsp + 0x44], 0
mov qword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x58], 0x43a50000
mov qword [rsp + 0x60], 0x3f3f3f3f
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], 0x3f3f3f3f
mov dword [rsp + 0x70], 0x3f3f3f3f
mov dword [rsp + 0x74], 0x3f3f3f3f
mov dword [rsp + 0x78], 0x3f3f3f3f
mov dword [rsp + 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x80], 0x3f3f3f3f
mov dword [rbp - 0x7c], 0x3f3f3f3f
mov dword [rbp - 0x78], 0x3f3f3f3f
mov dword [rbp - 0x74], 0x3f3f3f3f
mov dword [rbp - 0x70], 0x3f3f3f3f
mov dword [rbp - 0x6c], 0x3f3f3f3f
mov dword [rbp - 0x68], 0x3f3f3f3f
mov dword [rbp - 0x64], 0x3f3f3f3f
mov dword [rbp - 0x60], 0x3f3f3f3f
mov dword [rbp - 0x5c], 0x3f3f3f3f
mov dword [rbp - 0x58], 0x3f3f3f3f
mov dword [rbp - 0x54], 0x3f3f3f3f
mov dword [rbp - 0x50], 0x3f3f3f3f
mov dword [rbp - 0x4c], 0x3f3f3f3f
mov dword [rbp - 0x48], 0x3f3f3f3f
mov dword [rbp - 0x44], 0x3f3f3f3f
mov dword [rbp - 0x40], 0x3f3f3f3f
mov dword [rbp - 0x3c], 0x3f3f3f3f
mov dword [rbp - 0x38], 0x3f3f3f3f
mov dword [rbp - 0x34], 0x3f3f3f3f
mov dword [rbp - 0x30], 0x3f3f3f3f
mov dword [rbp - 0x2c], 0x3f3f3f3f
mov dword [rbp - 0x28], 0x3f3f3f3f
mov qword [rbp - 0x24], 0x3f3f3f3f
mov qword [rbp - 0x1c], 0
mov qword [rbp - 0x14], 0
mov qword [rbp - 0xc], 0
mov qword [rbp - 4], 0
mov qword [rbp + 4], 0
mov qword [rbp + 0xc], 0
mov dword [rbp + 0x14], 0x3f3f0000
mov qword [rbp + 0x18], 0x3f3f
mov qword [rbp + 0x20], 0
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x2c], 0xbf800000
mov qword [rbp + 0x30], 0x3f3f3f3f
mov qword [rbp + 0x38], 0x3f3f0000
mov dword [rbp + 0x40], 0
mov dword [rbp + 0x44], 0x3f3f3f3f
mov dword [rbp + 0x48], 0x3f3f3f3f
mov dword [rbp + 0x4c], 0x3f3f3f3f
mov dword [rbp + 0x50], 0x3f3f3f3f
mov qword [rbp + 0x54], 0x3f3f3f3f
mov qword [rbp + 0x5c], 0
lea rdi, [rsp + 0x20]
mov qword [0x180283e18], 0
movdqa xmmword [0x180283e20], xmm0
mov ecx, 0x144
call fcn.18003f81c
mov qword [0x180283e18], rax
mov qword [0x180283e20], rax
lea rbx, [rax + 0x144]
mov qword [0x180283e28], rbx
mov r8d, 0x144
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [0x180283e20], rbx
mov dword [0x180283e30], 0
mov rax, r14
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret