joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083da0
Capabilities:
Create thread

Disassembly:
jmp 0x140083da0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov edi, 1
xor eax, eax
lock cmpxchg dword [rcx], edi
je 0x140083dd3
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lock cmpxchg dword [rbx], edi
jne 0x140083dc0
xor esi, esi
cmp qword [rbx + 0x60], rsi
jne 0x140083e9f
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140083e31
cmp dword [reloc.WSOCK32.dll_accept], edi
jl 0x140083e9d
test byte [0x14016b76d], dil
je 0x140083e9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_the_helper_app_stop_event._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd2
jmp 0x140083e86
mov qword [rsp + 0x28], rsi
lea r8, [0x140083fa0]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x140083e9f
cmp dword [reloc.WSOCK32.dll_accept], edi
jl 0x140083e9d
test byte [0x14016b76d], dil
je 0x140083e9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Unable_to_create_the_helper_app_maintenance_thread._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xdd
lea r9, str..._rsrc_app.c
mov edx, edi
lea r8, str.rsrc_app_start_persistent_app
mov ecx, edi
call fcn.140003693
mov edi, esi
xchg dword [rbx], esi
mov rsi, qword [rsp + 0x58]
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400840b0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x70
mov dword [rcx], 9
xor eax, eax
mov qword [rcx + 4], rax
mov rbx, rcx
mov qword [rcx + 0xc], rax
lea rcx, [rsp + 0x58]
call fcn.1400049cb
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
cmp qword [rsp + 0x44], 0
je 0x14008419c
mov r8, qword [rsp + 0x44]
lea r9, str.DPTF
lea rdx, str._s_s
lea rcx, [rsp + 0x58]
call fcn.1400018f7
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x140084192
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140084192
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140084192
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x14008417c
test byte [0x14016b76d], 1
je 0x14008417c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov edx, 1
lea r9, str..._rsrc_file.c
mov ecx, edx
lea rax, str.Unable_to_create_temporary_directory._Error___d
mov qword [rsp + 0x28], rax
lea r8, str.rsc_dll_create_esif_temp_directory
mov dword [rsp + 0x20], 0x11a
call fcn.140003693
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x14008418a
call fcn.140002d65
mov qword [rbx + 4], 0
mov rcx, qword [rsp + 0x44]
call fcn.140002d65
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x1400841f0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x70
mov dword [rcx], 9
xor eax, eax
mov qword [rcx + 4], rax
mov rbx, rcx
mov qword [rcx + 0xc], rax
mov rsi, rdx
lea rcx, [rsp + 0x58]
call fcn.1400840b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
cmp qword [rsp + 0x44], 0
je 0x1400842e0
mov r9, qword [rsi + 4]
lea rdx, [0x14013d850]
mov r8, qword [rsp + 0x44]
lea rcx, [rsp + 0x58]
call fcn.1400018f7
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x1400842d6
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400842d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400842d6
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x1400842c0
test byte [0x14016b76d], 1
je 0x1400842c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov edx, 1
lea r9, str..._rsrc_file.c
mov ecx, edx
lea rax, str.Unable_to_create_temporary_directory._Error___d
mov qword [rsp + 0x28], rax
lea r8, str.rsc_dll_create_esif_temp_sub_directory
mov dword [rsp + 0x20], 0xf2
call fcn.140003693
mov rcx, qword [rbx + 4]
test rcx, rcx
je 0x1400842ce
call fcn.140002d65
mov qword [rbx + 4], 0
mov rcx, qword [rsp + 0x44]
call fcn.140002d65
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rsi
ret

Function at 0x1400845f0
Capabilities:
Delete directory
Delete file

Disassembly:
jmp 0x1400845f0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 4]
test rcx, rcx
je 0x14008460f
call fcn.140002d65
mov qword [rbx + 4], 0
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x140084634
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x2c]
test rcx, rcx
je 0x14008462c
call fcn.140002d65
mov qword [rbx + 0x2c], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140084659
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140084651
call fcn.140002d65
mov qword [rbx + 0x18], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140085900
Capabilities:
Start service

Disassembly:
jmp 0x140085900
push rbx
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14008593b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_get_handle_to_the_SCM._Status___d_n
lea ecx, [rbx + 3]
add rsp, 0x20
pop rbx
jmp fcn.1400049c1
mov r8d, 0xf01ff
mov qword [rsp + 0x30], rdi
lea rdx, str.esifsvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140085978
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_open_service_handle._Status___d_n
lea ecx, [rdi + 3]
call fcn.1400049c1
jmp 0x1400859d4
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400859b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1400859b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error:_Unable_to_start_the_service._Status___d_n
mov ecx, 3
mov r8d, eax
call fcn.1400049c1
jmp 0x1400859cb
lea r8, str.Intel_R__Dynamic_Platform_and_Thermal_Framework_Service
mov ecx, 3
lea rdx, str._S_started._n
call fcn.1400049c1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]

Function at 0x140085a30
Capabilities:
Stop service

Disassembly:
jmp 0x140085a30
push rbx
sub rsp, 0x50
mov rax, qword [0x14016c1f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140085a88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_get_handle_to_the_SCM._Status___d_n
lea ecx, [rbx + 3]
call fcn.1400049c1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004ca5
add rsp, 0x50
pop rbx
ret
mov r8d, 0xf01ff
mov qword [rsp + 0x60], rdi
lea rdx, str.esifsvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140085ac5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error:_Unable_to_open_service_handle._Status___d_n
lea ecx, [rdi + 3]
call fcn.1400049c1
jmp 0x140085b24
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140085b03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x140085b03
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error:_Unable_to_stop_the_service._Status___d_n
mov ecx, 3
mov r8d, eax
call fcn.1400049c1
lea r8, str.Intel_R__Dynamic_Platform_and_Thermal_Framework_Service
mov ecx, 3
lea rdx, str._S_stopped_n
call fcn.1400049c1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004ca5
add rsp, 0x50
pop rbx
ret
Function at 0x140085ff0
Capabilities:
Access the windows event log

Disassembly:
jmp 0x140085ff0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movzx esi, dx
movzx ebp, cx
xorps xmm0, xmm0
lea rdx, str.DPTF
xor ecx, ecx
xor ebx, ebx
movdqu xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
je 0x1400860b1
mov rdx, qword [rsp + 0xd0]
lea rax, [0x14013e308]
lea r8, [rsp + 0xd8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
call fcn.140004b29
mov ecx, 2
mov r9d, 0x100
movzx r8d, bp
movups xmm0, xmmword [rax]
lea rax, str.Error_in_formatting_event_message
movups xmmword [rsp + 0x60], xmm0
mov rbx, qword [rsp + 0x64]
test rbx, rbx
cmovne rax, rbx
xor edx, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rdx
movzx edx, si
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test rbx, rbx
je 0x1400860be
mov rcx, rbx
call fcn.140002d65
test rdi, rdi
je 0x1400860cc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14008e3f0
Capabilities:
Create thread

Disassembly:
jmp 0x14008e3f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor edi, edi
call fcn.140001d5c
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14008e47b
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x14008e51d
test byte [0x14016b76d], 1
je 0x14008e51d
lea rax, str.Unable_to_create_windows_thread_start_event.
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5e
mov edx, 1
lea r9, str...win_msg.c
mov ecx, edx
lea r8, str.win_msg_ctor
call fcn.140003693
jmp 0x14008e51d
mov qword [rsp + 0x28], rdi
lea r8, [0x14008e700]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rbx + 0x10], rbp
xor ecx, ecx
mov qword [rbx + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
jne 0x14008e4d0
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x14008e51d
test byte [0x14016b76d], 1
je 0x14008e51d
lea rax, str.Unable_to_create_windows_message_thread.
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], WSAStartup
jmp 0x14008e45c
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x18]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14008e518
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x14008e51d
test byte [0x14016b76d], 1
je 0x14008e51d
lea rax, str.Windows_message_thread_did_not_start_as_expected.
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7b
jmp 0x14008e45c
mov edi, 1
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14008fdac
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14008fdac
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14008fe3d
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14008fe3d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008fe3d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14008fe21
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14008fe1b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14008fe23
add rdx, 0x28
jmp 0x14008fe00
xor edx, edx
test rdx, rdx
jne 0x14008fe2c
xor al, al
jmp 0x14008fe43
test dword [rdx + 0x24], 0x80000000
je 0x14008fe39
xor al, al
jmp 0x14008fe43
mov al, 1
jmp 0x14008fe43
xor al, al
jmp 0x14008fe43
add rsp, 0x18
ret

Function at 0x1400c26e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400c26e4
jmp 0x1400c259c
push rbx
sub rsp, 0x50
mov rax, qword [0x14016c1f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r10d, r10d
mov rbx, r8
mov eax, r10d
mov r11, rdx
cmp rax, 0x20
mov r9, rcx
jae 0x1400c269b
mov byte [rsp + rax + 0x20], r10b
inc rax
cmp rax, 0x20
jl 0x1400c25c4
movzx r8d, byte [r11]
inc r11
mov edx, r8d
mov eax, r8d
shr rdx, 3
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
mov byte [rsp + rdx + 0x20], cl
test r8b, r8b
jne 0x1400c25d8
test r9, r9
jne 0x1400c2605
mov r9, qword [rbx]
movzx r8d, byte [r9]
mov edx, 1
mov ecx, r8d
shr r8, 3
and ecx, 7
shl edx, cl
test byte [rsp + r8 + 0x20], dl
je 0x1400c264a
mov r8b, byte [r9]
test r8b, r8b
je 0x1400c264a
inc r9
mov edx, 1
movzx r8d, byte [r9]
mov eax, r8d
mov ecx, r8d
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x1400c2624
mov r11, r9
jmp 0x1400c266e
movzx r8d, byte [r9]
mov edx, 1
mov ecx, r8d
shr r8, 3
and ecx, 7
shl edx, cl
test byte [rsp + r8 + 0x20], dl
jne 0x1400c2675
inc r9
cmp byte [r9], r10b
jne 0x1400c264f
jmp 0x1400c267b
mov byte [r9], r10b
inc r9
cmp r9, r11
mov qword [rbx], r9
cmovne r10, r11
mov rax, r10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140004ca5
add rsp, 0x50
pop rbx
ret
call fcn.140002275
int3
sub rsp, 0x28
test r8, r8
jne 0x1400c2704
call fcn.1400033cd
mov dword [rax], socket
call fcn.140004845
xor eax, eax
add rsp, 0x28
ret
test rdx, rdx
je 0x1400c26ed
test rcx, rcx
jne 0x1400c2713
cmp qword [r8], rcx
je 0x1400c26ed
add rsp, 0x28
jmp 0x140002bd5
Function at 0x1400fb4a0
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400fb4a0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, [0x140148258]
mov r14, rcx
lea r8, [0x140148250]
lea rdx, [0x140148260]
mov ecx, listen
call fcn.1400faa8c
mov rbx, rax
test rax, rax
je 0x1400fb503
mov rcx, rax
call qword [section..00cfg]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x1400fb51d
xor edx, edx
mov rcx, r14
call fcn.1400030c6
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400ff314
Capabilities:
Delete file

Disassembly:
jmp 0x1400ff314
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ff334
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140004138
or eax, 0xffffffff
jmp 0x1400ff336
xor eax, eax
add rsp, 0x28
ret

Function at 0x140100f84
Capabilities:
Create thread
Print debug messages

Disassembly:
jmp 0x140100f84
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14000361b
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x140100fd7
test rbx, rbx
je 0x140100fc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x140100fd7
mov edi, 4
jmp 0x140101080
call fcn.1400016b8
test al, al
jne 0x140100ff4
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x140101080
test bpl, bpl
je 0x140101057
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x140100ddc]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140101080
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x140101051
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140101080
mov edi, dword [rsp + 0x44]
jmp 0x140101049
call fcn.140004cb4
test al, al
jne 0x140101068
bts esi, 0x15
xor ecx, ecx
jmp 0x140101070
call fcn.140002496
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.140003ecc
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x18063d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18063d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18063d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18063d06f
add dl, dl
jne 0x18063d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18063d0f6
xor eax, eax
add dl, dl
jne 0x18063d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18063d1ad
add dl, dl
jne 0x18063d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18063d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18063d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18063d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18063d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18063d07e
mov eax, 1
add dl, dl
jne 0x18063d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18063d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18063d0fb
sub eax, ebx
mov ebx, 1
jne 0x18063d14c
mov ecx, 1
add dl, dl
jne 0x18063d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18063d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18063d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18063d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18063d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18063d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18063d15d
cmp eax, 0x7d00
jae 0x18063d19b
cmp eax, 0x500
jb 0x18063d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18063d07e
cmp eax, 0x7f
ja 0x18063d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18063d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18063d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18063d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, [rsp + 0x60]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 1
jne 0x14000112a
lea rdx, str.Generating_Bobux...
call fcn.140001150
mov rcx, rax
lea rdx, [0x140001320]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rbx + 1]
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0x999999
mov edx, 0xffffffff
mov dword [rsp + 0x38], 2
mov r9d, edi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov qword [rsp + 0x28], rbx
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x1400010d8
lea rdx, str.Something_went_wrong__Please_try_again_later_
call fcn.140001150
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001ca8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cf2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cf2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cf2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cf2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cf2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cf4
xor al, al
add rsp, 0x28
ret
Function at 0x14000fb40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140062ea8]
mov edi, edx
cmp byte [rbx + 0x1f4d], 0
jne 0x14000fba0
cmp byte [rbx + 0x1f4e], 0
jne 0x14000fba0
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002880
test dil, 1
je 0x14000fcbe
jmp 0x14000fc28
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2ff8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400586f8]
mulss xmm1, dword [0x1400586e0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cc8], rax
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc0], xmm0
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140058648]
or dword [rbx + 0x1cb0], 0x41
movss dword [rbx + 0x1d10], xmm0
call fcn.140002880
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14000fc78
lea r11, [0x140052de0]
cmp r9b, 0x23
jne 0x14000fc5b
cmp byte [r8], r9b
jne 0x14000fc5b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14000fc48
not ecx
call fcn.140009600
test rax, rax
je 0x14000fcbe
cmp byte [rax + 0x8e], 0
je 0x14000fcbe
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.140002880
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000bc60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004f780
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret