joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e5cc
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140077168]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14007dfa0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14007de80], ecx
jg 0x14004e6ae
mov eax, ebx
cmp rbx, rax
jne 0x14004e670
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x14004e670
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x14007de78]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x14004e6f1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140056d30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.1400072f0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004e2fc
lea rdx, [0x140074120]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x14007de80]
call fcn.140056ab4
cmp dword [0x14007de80], 0xffffffff
jne 0x14004e618
lea rcx, [0x14007de78]
call fcn.14004e210
lea rcx, [0x14005a07c]
call fcn.1400565a4
nop
lea rcx, [0x14007de80]
call fcn.140056a54
jmp 0x14004e618
mov ecx, eax
call fcn.14004e734
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x140062858]
lea rcx, [rsp + 0x20]
call fcn.1400072f0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14004e2fc
lea rdx, [0x140074120]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14004fb38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x14004fbab
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x14004fb6a
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x14004fbed
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x14004fbd9
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14004fc08
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14004fcce
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x14004fc99
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x14004fc4e
test rbx, rbx
je 0x14004fcb6
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x14004fca4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14004fcd0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004fd7d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x14004fd55
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14004fd0d
test rbx, rbx
je 0x14004fd6b
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x14004fd5d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140055c94
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140055ce3
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x140055cba
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x14005711c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140057166
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140057166
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140057166
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140057166
cmp dword [rcx + 0x84], 0xe
jbe 0x140057166
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140057168
xor al, al
add rsp, 0x28
ret
Function at 0x1800029b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x138
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x5a4d
cmp cx, word [rax]
jne 0x180002b8e
movsxd rcx, dword [rax + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x180002b8e
mov qword [rsp + 0x140], rbx
xor edx, edx
mov qword [rsp + 0x150], rsi
mov r8d, 0x104
mov esi, dword [rcx + rax + 0x28]
lea rcx, [rsp + 0x20]
lea rbx, [rsi + rax]
call fcn.1800058b0
test rsi, rsi
je 0x180002a7e
lea rcx, str.kernel32.dll
mov qword [rsp + 0x130], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x180002a76
movzx edx, si
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180002a76
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.18000509c
test rax, rax
je 0x180002a76
lea r8, [rax + 1]
mov edx, 0x104
lea rcx, [rsp + 0x20]
call fcn.180009c84
mov rdi, qword [rsp + 0x130]
mov edx, 0x10
lea r9, [rsp + 0x148]
mov rcx, rbx
lea r8d, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x150]
test eax, eax
je 0x180002b86
mov dword [rbx], 0x54535251
lea rcx, [0x1800026e0]
mov dword [rbx + 4], 0x41575655
lea r9, [rsp + 0x148]
mov dword [rbx + 8], 0x41514150
mov rax, rcx
mov dword [rbx + 0xc], 0x41534152
mov edx, 0x10
mov dword [rbx + 0x10], 0x41554154
mov dword [rbx + 0x14], 0x48574156
mov dword [rbx + 0x18], 0xb0ec81
mov dword [rbx + 0x1c], 0xba480000
mov byte [rbx + 0x20], cl
shr rax, 8
mov byte [rbx + 0x21], al
mov rax, rcx
shr rax, 0x10
mov byte [rbx + 0x22], al
mov rax, rcx
shr rax, 0x18
mov byte [rbx + 0x23], al
mov rax, rcx
shr rax, 0x20
mov byte [rbx + 0x24], al
mov rax, rcx
shr rax, 0x28
mov byte [rbx + 0x25], al
mov rax, rcx
shr rcx, 0x38
shr rax, 0x30
mov byte [rbx + 0x26], al
mov byte [rbx + 0x27], cl
mov rcx, rbx
mov dword [rbx + 0x28], 0x8148d2ff
mov dword [rbx + 0x2c], 0xb0c4
mov dword [rbx + 0x30], 0x415f4100
mov dword [rbx + 0x34], 0x415d415e
mov dword [rbx + 0x38], 0x415b415c
mov dword [rbx + 0x3c], 0x4159415a
mov dword [rbx + 0x40], 0x5d5e5f58
mov dword [rbx + 0x44], 0x595a5b5c
mov byte [rbx + 0x48], 0xc3
mov r8d, dword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x140]
add rsp, 0x138
ret
Function at 0x180003150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800031c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800031c8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1800031b5
nop
cmp rbx, rcx
jae 0x1800031c8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800031a0
cmp rbx, rcx
jae 0x1800031c8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1800031ca
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800031f0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov qword [0x18001fe58], rcx
mov rbx, rcx
cmp edx, 1
jne 0x180003232
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, str.OutPutDebugString.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x18000322a
lea rcx, str.error
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.1800029b0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18000d5a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000d5d8
xor eax, eax
jmp 0x18000d69b
mov rbp, rbx
cmp word [rax], si
je 0x18000d5fd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000d5e4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000d5e0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000d4c8
movsxd r14, eax
test eax, eax
jne 0x18000d63b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000d5d1
mov rcx, r14
call fcn.18000e720
mov rdi, rax
test rax, rax
jne 0x18000d654
xor ecx, ecx
call fcn.18000b0ec
jmp 0x18000d630
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000d4c8
test eax, eax
jne 0x18000d685
mov rcx, rdi
call fcn.18000b0ec
jmp 0x18000d68f
xor ecx, ecx
call fcn.18000b0ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400012b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 2
call fcn.1400013f0
mov rdx, qword [0x140005668]
lea r8, [rsp + 0x38]
mov rcx, qword [0x140005670]
add rdx, 0x16d4f48
mov r9d, 8
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1400012d0
mov rcx, qword [0x140005670]
lea r8, [rsp + 0x30]
add rdx, 0x3c8
mov dword [rsp + 0x30], ebx
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400012d0
test byte [rsp + 0x30], 1
je 0x1400012d0
mov rdx, qword [0x140005668]
lea r8, [rsp + 0x30]
mov rcx, qword [0x140005670]
add rdx, 0x16ce390
mov r9d, 4
mov dword [rsp + 0x30], 0x10001
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 1
call fcn.1400013f0
mov rdx, qword [0x140005668]
lea r8, [rsp + 0x30]
mov rcx, qword [0x140005670]
add rdx, 0x16ce390
mov r9d, 4
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1400012d0

Function at 0x140001e98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ee2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ee2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ee2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ee2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ee2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ee4
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1400235c0], 0
lea rdi, [0x1400231c0]
mov r10d, edx
mov r9, rcx
jne 0x1400010f0
mov qword [rsp + 0x10], rbx
xor r11d, r11d
mov rbx, rdi
nop word [rax + rax]
mov eax, r11d
lea rbx, [rbx + 4]
mov r8d, r11d
shr r8d, 1
mov ecx, r8d
xor ecx, 0xedb88320
and al, 1
cmove ecx, r8d
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov r8d, eax
xor r8d, 0xedb88320
and dl, 1
cmove r8d, eax
mov ecx, r8d
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
and r8b, 1
cmove eax, ecx
inc r11d
mov dword [rbx - 4], eax
cmp r11d, 0x100
jb 0x140001030
mov rbx, qword [rsp + 0x10]
mov dword [0x1400235c0], 1
mov eax, 0xffffffff
test r10d, r10d
je 0x14000111c
mov r8, r10
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [rdi + rcx*4]
sub r8, 1
jne 0x140001100
not eax
pop rdi
ret
Function at 0x140001120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov edi, ecx
mov rdx, qword [rax + 0x18]
mov rbx, qword [rdx + 0x10]
cmp qword [rbx + 0x30], 0
je 0x140001250
xor ebp, ebp
lea rsi, [0x140022ac0]
nop dword [rax + rax]
mov r10, qword [rbx + 0x60]
movzx edx, word [rbx + 0x58]
test r10, r10
jne 0x140001177
mov rcx, rbp
mov edx, ebp
jmp 0x140001238
xor r8d, r8d
mov rax, rsi
xorps xmm0, xmm0
lea ecx, [r8 + 3]
nop dword [rax]
nop dword [rax + rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x140001190
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x70], r8
mov dword [rax + 0x78], r8d
mov word [rax + 0x7c], r8w
cmp bp, dx
jae 0x140001221
mov r8, rsi
sub r10, rsi
mov r9, rdx
nop dword [rax]
nop word [rax + rax]
movzx edx, word [r10 + r8]
lea r8, [r8 + 2]
lea eax, [rdx - 0x41]
cmp eax, 0x19
lea ecx, [rdx + 0x20]
cmova cx, dx
mov word [r8 - 2], cx
sub r9, 1
jne 0x140001200
mov edx, ebp
mov rcx, rsi
cmp word [0x140022ac0], dx
je 0x140001238
nop
inc edx
cmp word [rsi + rdx*2], bp
jne 0x140001230
add edx, edx
call section..text
cmp eax, edi
je 0x140001267
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], rbp
jne 0x140001160
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x140001252
Function at 0x140009ce4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009a48
Function at 0x140133d30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140133d3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140133d4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140133d35
lea eax, [rcx + 1]
jmp 0x140133d5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140133d6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140133d54
sub eax, 3
jb 0x140133d8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140133ddd
sar eax, 1
movsxd rbp, eax
jb 0x140133dc4
jmp 0x140133d9c
add ebx, ebx
jne 0x140133d9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140133dc4
inc ecx
add ebx, ebx
jne 0x140133daa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140133dc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140133dbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140133dac
add ecx, 2
jmp 0x140133dc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140133cf2
jmp 0x140133d3d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x27800
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140133e2d
cmp rsi, rcx
jae 0x140133e35
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140133e14
cmp al, 0x8f
ja 0x140133e14
cmp byte [rsi - 2], 0xf
je 0x140133e1a
sub al, 0xe8
cmp al, 1
ja 0x140133dfe
cmp rsi, rcx
jae 0x140133e35
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140133e04
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140133e35
lodsb al, byte [rsi]
jmp 0x140133e14
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x11a000]
mov eax, dword [rdi]
or eax, eax
je 0x140133e92
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x134b28]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140133e42
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140133e8c
mov qword [rbx], rax
add rbx, 8
jmp 0x140133e62
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140133ecc
cmp al, 0xef
ja 0x140133ebe
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140133e9e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140133ead
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140133f20
sub rsp, 0xffffffffffffff80
jmp 0x140013b30
Function at 0x140005710
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14007f180]
xor rax, rsp
mov qword [rbp + 0x60], rax
lea rcx, str.WINDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005751
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000da20
nop
mov r8d, 0x1b
lea rdx, str.System32driversetchosts
lea rcx, [rsp + 0x30]
call fcn.14000c660
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000b070
nop
cmp qword [rbp - 0x28], 0
je 0x14000580a
lea rdx, str.127.0.0.1_xboxlive.com_n
lea rcx, [rsp + 0x50]
call fcn.14000ccc0
lea rdx, str.127.0.0.1_user.auth.xboxlive.com_n
lea rcx, [rsp + 0x50]
call fcn.14000ccc0
lea rdx, str.127.0.0.1_presence_heartbeat.xboxlive.com_n
lea rcx, [rsp + 0x50]
call fcn.14000ccc0
lea rcx, [rsp + 0x58]
call fcn.14000c410
test rax, rax
jne 0x14000580a
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x58], rax
cmp qword [rbp - 0x28], 0
je 0x14000586d
mov rax, qword [rsp + 0x70]
lea rcx, [rbp - 0x38]
cmp qword [rax], rcx
jne 0x14000586d
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x70]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x58]
mov dword [rax], edx
cmp byte [rbp - 0x2c], 0
je 0x14000587d
lea rcx, [rsp + 0x58]
call fcn.14000c410
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400058df
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400058da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005cac4
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14005c750
add rsp, 0x170
pop rbp
ret