joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400077d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1400d7d10]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x140007864
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14001bce0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007880
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x1400d7d10]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x14000b160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x140113a80]
mov r15d, edx
mov r12d, dword [rsp + 0x90]
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
mov eax, dword [rbx + 0x14]
movss xmm2, dword [rbx + 0x250]
and eax, 4
movss xmm3, dword [rbx + 0x254]
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x14000b1c6
cmp qword [rdi + 0x4b30], 0
je 0x14000b1ce
movss xmm2, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
xor r14d, r14d
subss xmm2, dword [rbx + 0x100]
subss xmm3, dword [rbx + 0x104]
xorps xmm5, xmm5
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
jp 0x14000b209
mov eax, 1
je 0x14000b20c
mov eax, r14d
ucomiss xmm0, xmm5
jp 0x14000b219
jne 0x14000b219
mov r14d, 2
movss xmm4, dword [0x1400de7c8]
or r14d, eax
comiss xmm5, xmm1
jb 0x14000b234
addss xmm2, xmm1
movaps xmm1, xmm2
maxss xmm1, xmm4
comiss xmm5, xmm0
jb 0x14000b244
addss xmm3, xmm0
movaps xmm0, xmm3
maxss xmm0, xmm4
or dword [rdi + 0x47b0], 2
xor edx, edx
movss dword [rdi + 0x47d0], xmm1
movss dword [rdi + 0x47d4], xmm0
mov dword [rdi + 0x47b8], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14000b28d
mov dword [rsp + 0x28], r15d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140003d60
jmp 0x14000b2a3
lea r8, str._s__08X
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.140003d60
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
movss xmm6, dword [rdi + 0x37f8]
xor edx, edx
call fcn.14000de40
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r15d
mov byte [rsi + 0xd2], r14b
jne 0x14000b2f1
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r15d
lea rdx, [0x1400d6d01]
not r9d
lea r10, [0x1400d7d10]
mov ebx, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_35
nop dword [rax + rax]
cmp r8b, 0x23
jne 0x14000b323
cmp byte [rdx], r8b
jne 0x14000b323
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14000b310
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x14000b353
xor edx, edx
xor ecx, ecx
call fcn.140007a70
cmp dword [rdi + 0x48c8], r15d
jne 0x14000b3a0
bt r12d, 0x17
jb 0x14000b3a0
cmp word [rsi + 0x15c], 0
jne 0x14000b376
cmp byte [rsi + 0x162], 0
je 0x14000b3a0
xor edx, edx
mov rcx, rsi
call fcn.140010270
xor edx, edx
mov rcx, rsi
call fcn.1400168f0
mov rdx, rsi
mov ecx, ebx
call fcn.140007a70
mov eax, dword [rdi + 0x48ec]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140014670
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140113a80]
mov edi, ecx
cmp byte [rbx + 0x4a79], 0
jne 0x1400146d1
cmp byte [rbx + 0x4a7a], 0
jne 0x1400146d1
movsx r9d, word [rbx + 0x5bb2]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003ce0
test dil, 2
je 0x1400147ff
jmp 0x14001475c
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400de7f8]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400de7e4]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47c8], rax
mov dword [rbx + 0x47b4], 1
movss dword [rbx + 0x47c0], xmm0
movss dword [rbx + 0x47c4], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x1400de708]
or dword [rbx + 0x47b0], 0x41
movss dword [rbx + 0x4810], xmm0
call fcn.140003ce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400147b0
lea r11, [0x1400d7d10]
nop dword [rax]
cmp r9b, 0x23
jne 0x140014793
cmp byte [r8], r9b
jne 0x140014793
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014780
not ecx
call fcn.14000b6e0
test rax, rax
je 0x1400147ff
cmp byte [rax + 0xb6], 0
je 0x1400147ff
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.140003ce0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000de40
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c1df0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001a510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a5b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001a56a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001ca30
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400047f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140113a78]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a5bf
mov rcx, rbx
call fcn.1400047f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001aa40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140113a80]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001aaa3
mov qword [rsp], rbx
lea rbx, [0x1400d7d10]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001aa83
cmp byte [r8], r9b
jne 0x14001aa83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001aa70
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c10]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001aad7
mov r10, qword [r10 + 0x5c18]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001aade
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001aac4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14002e1e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140113a80]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002e3ae
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002e3ae
mov rax, qword [0x140113a80]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
test rax, rax
je 0x14002e24b
inc dword [rax + 0xec]
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14002e278
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
jmp 0x14002e27b
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov rax, qword [0x140113a80]
mov dword [rdi + 0x28], 9
test rax, rax
je 0x14002e2c5
mov rsi, qword [rax + 0x90]
jmp 0x14002e2c8
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14002e2f3
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140113a80]
mov rcx, qword [rax + 0x48b0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop dword [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14002e36e
inc rbx
cmp rbx, 5
jl 0x14002e350
jmp 0x14002e39a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14002e3b0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c1df0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x140049990
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, r8d
mov rdi, rdx
xor edx, edx
cmp ecx, 0x7b
ja 0x1400499c4
movsxd rax, ecx
lea rdx, [0x140112620]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1400de900]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
test rdx, rdx
jne 0x1400499f3
mov r8d, 0xa
lea rdx, str.Select_Key
jmp 0x140049a0a
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140049a00
lea rcx, [rsp + 0x38]
call fcn.1400589e0
cmp ebx, 1
jne 0x140049a30
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Press_the_key
lea rcx, [rsp + 0x38]
call fcn.1400589e0
mov dword [rsp + 0x30], 0x42fa0000
mov dword [rsp + 0x34], 0x41c80000
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.140031400
test al, al
je 0x140049a81
test ebx, ebx
jne 0x140049a81
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140049ac1
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049abc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049abc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2180
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c1df0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14004e1e0
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004e287
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004e287
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004e282
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14004e260
cmp r8d, 0x491e0a9c
je 0x14004e28c
test r9d, r9d
jne 0x14004e240
mov rax, qword [rax]
jmp 0x14004e210
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, str.C:ProgramDatadriver.exe
add rax, r10
call rax
call fcn.14004dbf0
lea rcx, str.shutdown__r__t_1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x14004f760
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x1400dc510]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004f807
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004f807
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14004f802
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14004f7e0
cmp r8d, 0xf8f45725
je 0x14004f80c
test r9d, r9d
jne 0x14004f7c0
mov rcx, qword [rcx]
jmp 0x14004f790
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, str.NtSetInformationThread
add rax, r10
mov rcx, rsi
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004f8c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004f8c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rdi + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x14004f8c2
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x14004f8a0
cmp r8d, 0x9bc5a608
je 0x14004f8cc
test r9d, r9d
jne 0x14004f880
mov rcx, qword [rcx]
jmp 0x14004f850
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recvfrom
call rsi
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov rsi, qword [rsp + 0x38]
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14004f930
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004f94e
test ebx, ebx
je 0x14004fa06
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14004f9e6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14004f9e6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004f9d8
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14004f9c0
cmp r8d, 0xcded1a85
je 0x14004f9eb
test r9d, r9d
jne 0x14004f9a0
mov rax, qword [rax]
jmp 0x14004f970
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14004fa40
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14004fa53
add rsp, 0x28
ret
Function at 0x14004fa60
Capabilities:
Access peb ldr_data
Encode data using xor
Execute anti-debugging instructions
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, 0x1f4
jbe 0x14004fc92
xor ecx, ecx
mov qword [rsp + 0x50], rbx
mov eax, 1
cpuid
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
test ecx, ecx
jns 0x14004fafc
mov eax, 0x40000000
lea r8, vtable.type_info.0
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
lea rax, str.KVMKVMKVM
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], ecx
mov rbx, qword [rsp + 0x20]
nop dword [rax]
mov rcx, qword [rax]
cmp qword [rcx], rbx
jne 0x14004faf3
cmp dword [rcx + 8], edx
jne 0x14004faf3
cmp byte [rcx + 0xc], 0
je 0x14004fb15
add rax, 8
cmp rax, r8
jne 0x14004fae0
xor al, al
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c1df0
add rsp, 0x48
ret
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14004fba4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14004fba4
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov ebx, 0x811c9dc5
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14004fb9f
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14004fb80
cmp ebx, 0x23a979e4
je 0x14004fba9
test r8d, r8d
jne 0x14004fb60
mov rax, qword [rax]
jmp 0x14004fb30
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
lea r8, str.Fatal_Error
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
lea rdx, str.Virtual_Machines_Are_Not_Allowed_
add rax, r9
xor ecx, ecx
mov r9d, reloc.WS2_32.dll_recv
call rax
call fcn.14004e1e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x14004fc64
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x14004fc64
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov ebx, 0x811c9dc5
lea rcx, [rdi + r8*4]
mov ecx, dword [rcx + r9]
add rcx, r9
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14004fc5f
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, ebx
imul ebx, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14004fc40
cmp ebx, 0xcded1a85
je 0x14004fc69
test r8d, r8d
jne 0x14004fc20
mov rax, qword [rax]
jmp 0x14004fbf0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r9
call rax
mov rdi, qword [rsp + 0x40]
xor al, al
jmp 0x14004fafe
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c1df0
add rsp, 0x48
ret