joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14036d800
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x14054f998]
xor rax, rsp
mov qword [rsp + 0x230], rax
movabs rdi, 0xa3d3020ee34b4bef
mov rax, qword [0x1405623e0]
test rax, rax
je 0x14036d8cd
movabs rax, 0x4a6fdd95ef42331
mov ecx, dword [0x1405624b4]
cmp ecx, 0xe
jg 0x14036d85e
inc qword [0x140546190]
mov rsi, qword [0x1405623e0]
xor ecx, ecx
test cl, cl
je 0x14036d8b1
mov rcx, qword [0x140546190]
mov rdx, rcx
neg rdx
mov r8, rdx
sub r8, rcx
inc r8
mov r9, rdi
sub r9, rax
add r9, qword [0x140547f60]
add r9, rax
imul r8, rdx
add r9, rcx
add r9, r8
shl r9, cl
shl r9, cl
mov rdx, r9
xor rdx, rcx
and r9, rcx
lea rcx, [rdx + r9*2]
mov qword [0x140546190], rcx
mov rcx, qword [0x1405623e0]
jmp 0x14036d84a
mov eax, esi
not eax
and eax, 0x11223344
and rsi, 0xffffffffeeddccbb
or rsi, rax
test rsi, rsi
jne 0x14036d9f9
movaps xmm0, xmmword [0x140446d10]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x1804242b697f3d33
mov qword [rsp + 0x40], rax
movzx eax, byte [0x140547f58]
add al, 7
mov ecx, 0xffffdb99
add ecx, dword [0x140547c84]
mov byte [rsp + 0x48], al
movsxd rax, ecx
add rax, qword [0x140547c90]
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov edx, 6
mov r8d, 0xed48e103
mov r9d, 0xf29cb72a
call qword [case.0x140119ecb.0]
mov rax, qword [0x140547f60]
mov rcx, rdi
xor rcx, rax
and rdi, rax
lea rax, [rcx + rdi*2]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140547c80]
sub eax, dword [0x140547f68]
add eax, 0x9c92825a
cdqe
add rax, qword [0x140547c98]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xd6c05557
mov r9d, 0x5f397b2d
call qword [case.0x140119ecb.0]
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
test rax, rax
je 0x14036d9d9
mov rax, qword [0x1405623e0]
test rax, rax
jne 0x14036d9d9
mov eax, dword [0x1405624b4]
cmp eax, 0x1f
jg 0x14036d9be
mov qword [0x1405623e0], rsi
xor qword [0x1405623e0], 0x11223344
xor eax, eax
test al, al
je 0x14036d9d9
mov qword [0x1405623e0], rsi
mov rax, qword [0x1405623e0]
mov qword [0x1405623e0], 0
jmp 0x14036d9a6
xor eax, eax
test al, al
nop dword [rax]
mov eax, dword [0x140547f68]
mov ecx, eax
xor ecx, 0x636d593f
and eax, 0x636d593f
add eax, eax
add eax, ecx
jne 0x14036d9e0
xor eax, eax
test al, al
jne 0x14036da10
mov eax, dword [0x1405624b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
je 0x14036da23
mov eax, dword [0x1405624b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x14036da10
jmp 0x14036d9ff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1403dc990
mov rax, rsi
add rsp, 0x238
pop rdi
pop rsi
ret
Function at 0x140011154
Capabilities:
Write file on windows

Disassembly:
jmp 0x140029d80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400470fc]
call fcn.140011e74
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140029dd7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140029ee3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140029e7c
cmp qword [rbp + 0x28], 0
jle 0x140029e7c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140029e1c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011d93
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140029ed2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140029ed2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011802
Capabilities:
Terminate process

Disassembly:
jmp 0x14002c830
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400119fb
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002d360
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002d380
xor al, al
jmp 0x14002d401
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002d393
xor al, al
jmp 0x14002d401
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002d3bd
xor al, al
jmp 0x14002d401
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002d3d1
xor al, al
jmp 0x14002d401
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002d3e3
xor al, al
jmp 0x14002d401
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002d3ff
xor al, al
jmp 0x14002d401
mov al, 1
add rsp, 0x38
ret
Function at 0x140011cf8
Capabilities:
Create thread

Disassembly:
jmp 0x140017670
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x14003f040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x140047075]
call fcn.140011e74
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140011af5
mov r8, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.14001166d
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400118b1
nop
lea rcx, [rbp + 0x108]
call fcn.140011acd
lea rax, [0x140011091]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.14001148d
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x14001777c
lea rcx, [rbp + 8]
call fcn.140011285
jmp 0x140017795
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14001136b
nop
lea rcx, [rbp + 8]
call fcn.140011acd
lea rcx, [rbp - 0x30]
lea rdx, [0x140035840]
call fcn.140011bf9
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400116e5
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140011e47
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400243f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14003f040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400470fc]
call fcn.140011e74
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140024456
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002445d
mov al, 1
jmp 0x1400245ad
call fcn.14001141f
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14001141f
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140011b81
movzx eax, al
test eax, eax
je 0x1400244ae
xor al, al
jmp 0x1400245ad
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140024513
cmp dword [rbp + 0x154], 1
je 0x14002451e
cmp dword [rbp + 0x154], 3
je 0x14002459c
jmp 0x1400245ab
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14002456e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14002456e
xor al, al
jmp 0x1400245ad
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140024589
mov dword [rbp + 0x154], 1
jmp 0x140024593
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1400245ad
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400245ad
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400372c0]
call fcn.140011bf9
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400116e5
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140017a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140017ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140017ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140017aad
mov qword [rsi], rdi
call fcn.140017670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.firefox.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ret
invalid
add edx, ebx
sal byte [rdi - 0x5d], 0x85
jb 0x1400a137a
test eax, 0xb4178355
lodsb al, byte [rsi]
jg 0x1400a132d
mov esi, gs
push rax
jbe 0x1400a137f
sbb al, 0xff
xchg edi, eax
add al, 0x7f
int 0x16
and edx, dword [rcx - 0x78]
movsb byte [rdi], byte [rsi]
lodsd eax, dword [rsi]
movabs byte [0x7f34d8580899eb7f], al
fdiv dword [rdi + rdi*2]

Function at 0x140017b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140017bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140017b98
add rdi, rbx
sub rsi, rbx
je 0x140017bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140017b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140013500
mov rcx, r12
call fcn.140013600
jmp 0x140017b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140045f60
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140063ca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x14034ac40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x14034a8ed], 0
je 0x140063cd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x14034af00]
aesenc xmm0, xmmword [0x14034af10]
aesenc xmm0, xmmword [0x14034af20]
movq rax, xmm0
ret
jmp 0x14000a100

Function at 0x140117280
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1402ed620]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401172a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401172a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401172a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1401172f5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401172ec
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401172a0
add rax, 0x28
cmp rax, r9
jne 0x1401172d8
xor eax, eax
ret

Function at 0x140117300
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402ed620]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140117320
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140117328
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140117320
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1401173b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1402ed620]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1401173d0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1401173d8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x2fc4d5d60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d6762
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d67fa
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d67de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d67d2
cmp qword [rbp - 0x10], 0
je 0x2fc4d67d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6798
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d67fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6900
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6928
mov eax, 0
jmp 0x2fc4d6976
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6951
mov eax, 0
jmp 0x2fc4d6976
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6971
mov eax, 0
jmp 0x2fc4d6976
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d697c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d69fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d69f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d69f1
mov rax, qword [rbp - 8]
jmp 0x2fc4d6a0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d69c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800134e4
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x20
and dword [rax + 0x18], 0
lea rcx, str.Press_Key
and dword [rax + 0x1c], 0
mov rdi, rdx
movsxd rax, dword [rdx]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rax*8]
call fcn.180050e90
xor esi, esi
test al, al
je 0x18001353e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180013521
mov dword [rdi], esi
cmp dword [rdi], esi
jne 0x18001356f
mov ebx, esi
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18001356f
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18001356d
inc ebx
cmp ebx, 0x100
jl 0x180013544
jmp 0x18001356f
mov dword [rdi], ebx
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180013edc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
cmp qword [0x1800c32a0], rsi
je 0x180013f57
mov ecx, dword [0x1800c0cb0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180013f20
and dword [0x1800c3460], esi
and dword [0x1800c3464], esi
and dword [0x1800c3468], esi
mov qword [0x1800c3470], rsi
mov ecx, dword [0x1800c0cb0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180013f57
mov rdi, qword [0x1800c3420]
mov rbx, qword [0x1800c3418]
jmp 0x180013f52
mov rcx, qword [rbx]
test rcx, rcx
je 0x180013f4e
call fcn.180013978
add rbx, 8
cmp rbx, rdi
jne 0x180013f41
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18001de1c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword gs:[0x60]
xor edi, edi
mov rdx, rcx
test rax, rax
je 0x18001ded9
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r8, qword [rbx]
cmp r8, rbx
je 0x18001ded9
lea rsi, str.GameAssembly.dll
mov r9, qword [r8 + 0x50]
test r9, r9
je 0x18001ded1
mov rax, r9
mov ecx, edi
cmp word [r9], di
je 0x18001de7c
inc ecx
lea rax, [rax + 2]
cmp word [rax], di
jne 0x18001de71
mov rax, rsi
mov r10d, edi
inc r10d
lea rax, [rax + 2]
cmp word [rax], di
jne 0x18001de82
cmp ecx, r10d
jne 0x18001ded1
mov r11d, ecx
mov r10, rdi
test ecx, ecx
je 0x18001debc
movzx ecx, word [r9 + r10*2]
movzx eax, word [rsi + r10*2]
or cx, 0x20
or ax, 0x20
cmp cx, ax
jne 0x18001ded1
inc r10
cmp r10, r11
jb 0x18001de9d
mov rax, qword [r8 + 0x20]
mov qword [rdx], rax
mov eax, dword [r8 + 0x30]
mov qword [rdx + 0x10], rax
mov qword [rdx + 8], r9
jmp 0x18001deeb
mov r8, qword [r8]
cmp r8, rbx
jne 0x18001de5d
lea rax, [0x1800ab788]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rdi
mov rbx, qword [rsp + 8]
mov rax, rdx
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18001df00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov r8, qword [rcx]
mov r10, rdx
test r8, r8
je 0x18001dfac
movsxd rax, dword [r8 + 0x3c]
xor r11d, r11d
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
mov ebx, dword [r9 + 0x24]
add rbx, r8
cmp dword [r9 + 0x18], r11d
jbe 0x18001dfac
mov r14d, dword [r9 + 0x20]
mov ebp, 0xffffffff
lea rax, [r14 + r11*4]
mov edx, dword [rax + r8]
add rdx, r8
cmp rdx, rbp
je 0x18001dfa3
cmp r10, rbp
je 0x18001dfa3
cmp rdx, 0x7d
je 0x18001dfa3
cmp r10, 0x7d
je 0x18001dfa3
test rdx, rdx
je 0x18001df9e
test r10, r10
je 0x18001dfa3
movzx eax, byte [r10]
movzx ecx, byte [rdx]
sub ecx, eax
jne 0x18001df9a
mov rdi, r10
sub rdi, rdx
test al, al
je 0x18001df9a
inc rdx
movzx eax, byte [rdi + rdx]
movzx ecx, byte [rdx]
sub ecx, eax
je 0x18001df88
test ecx, ecx
jmp 0x18001dfa1
test r10, r10
je 0x18001dfc5
inc r11d
cmp r11d, dword [r9 + 0x18]
jb 0x18001df4c
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [r9 + 0x1c]
movzx edx, word [rbx + r11*2]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18001dfae
Function at 0x18002ebe8
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x18002ec5e
lea rbp, str.tier0_s64.dll
cmp rbp, 1
jbe 0x18002ec3a
mov rdx, qword [rbx + 0x50]
mov rcx, rbp
call fcn.180069f24
test eax, eax
je 0x18002ec75
cmp rbp, 1
jne 0x18002ec56
cmp word [rbx + 0x48], 0x12
jne 0x18002ec56
mov rax, qword [rbx + 0x50]
movabs rcx, 0x6c00640074006e
cmp qword [rax], rcx
je 0x18002ec75
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x18002ec20
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x18002ec60

Function at 0x180034324
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x1800aca60]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x18003432d
not r8d
mov eax, r8d
ret

Function at 0x180034358
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1800343b2
mov r11b, 0x23
lea rdi, [0x1800aca60]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18003439c
cmp rdx, 2
jb 0x18003439c
cmp byte [r10], r11b
jne 0x18003439c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18003437a
jmp 0x1800343f3
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1800343f3
mov r11b, 0x23
lea rdi, [0x1800aca60]
cmp dl, r11b
jne 0x1800343d7
cmp byte [r10], r11b
jne 0x1800343d7
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x1800343c5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret