joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400545d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400545fb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor ebx, ebx
mov dword [rsp + 0x58], 0x200
mov qword [rdi], rbx
xorps xmm0, xmm0
mov qword [rdi + 8], rbx
mov esi, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x40], rbx
movdqu xmmword [rsp + 0x60], xmm0
test rbp, rbp
je 0x140054680
or r8d, 0xffffffff
mov dword [rsp + 0x50], ebx
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140053c90
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x40], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x1400546d9
mov esi, ebx
test rsi, rsi
je 0x14005468e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14005469e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400546ae
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400546be
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x90], ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test eax, eax
je 0x140054680
mov edx, eax
mov rcx, rdi
call fcn.140054560
test rax, rax
je 0x140054680
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
mov r8d, ebp
call fcn.1400547c0
test eax, eax
jne 0x140054738
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005472c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
jmp 0x140054680
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x14005468e

Function at 0x1400547c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
cmp qword [rcx], 0
mov esi, r8d
mov rdi, rdx
mov r14, rcx
jne 0x1400547e3
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov ebx, ebp
test esi, esi
je 0x140054835
nop word [rax + rax]
mov rcx, qword [r14]
lea r9, [rsp + 0x50]
mov r8d, esi
mov dword [rsp + 0x50], ebp
sub r8d, ebx
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005484d
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14005484d
add rdi, rcx
add ebx, ecx
cmp ebx, esi
jb 0x140054800
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14005483a
Function at 0x140054860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp dword [0x140149a98], 0
mov ebx, edx
mov esi, ecx
jne 0x140054892
xor ecx, ecx
mov dword [0x140149a98], 1
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
cmp esi, ebx
jne 0x1400548a3
mov eax, esi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp esi, ebx
mov qword [rsp + 0x30], rdi
mov edi, esi
cmovle edi, ebx
cmovle ebx, esi
mov esi, edi
sub esi, ebx
inc esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
xor eax, edx
sub eax, edx
cdq
idiv esi
add edx, ebx
cmp edx, ebx
jl 0x1400548b8
cmp edx, edi
jg 0x1400548b8
mov rdi, qword [rsp + 0x30]
mov eax, edx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x140054a40
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140149a90]
test rax, rax
jne 0x140054af9
mov ecx, 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
mov r8d, 0x104
mov rcx, rax
mov qword [0x140149a90], rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, qword [0x140149a90]
xor ebx, ebx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
test rax, rax
je 0x140054abd
lea rdx, str..tmp
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
mov edx, 1
cmove ebx, edx
mov rcx, qword [0x140149a90]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test ebx, ebx
mov rbx, qword [rsp + 0x20]
je 0x140054ae5
mov rdx, qword [0x140149a90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [0x140149a90]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov rax, qword [0x140149a90]
add rsp, 0x28
ret
Function at 0x140054c40
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140054d99
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov qword [rsp + 0x40], rbx
mov rcx, qword [r8]
xor ebx, ebx
mov rdi, r8
mov esi, edx
test rcx, rcx
je 0x140054c70
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov rcx, qword [rdi + 0x18]
mov qword [rdi + 8], rbx
test rcx, rcx
je 0x140054c87
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x18], rbx
mov rcx, qword [rdi + 0x20]
mov dword [rdi + 0x28], ebx
test rcx, rcx
je 0x140054c9d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x2c], ebx
test rbp, rbp
je 0x140054d8d
cmp esi, 0xffffffff
jne 0x140054cba
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rsi + rbp], bl
jne 0x140054cb2
cmp esi, 1
jl 0x140054d8d
mov edx, 0xa
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r14
lea ecx, [rdx - 8]
call fcn.140054860
mov edx, 0xff
mov r12d, eax
mov ecx, 1
call fcn.140054860
lea r8, str._02X
mov edx, eax
mov rcx, rdi
mov r14d, eax
call fcn.140053d10
cmp r12d, 1
jl 0x140054d3e
mov qword [rsp + 0x58], r15
mov r15d, r12d
nop
mov edx, 0xff
mov ecx, 1
call fcn.140054860
xor eax, r14d
lea r8, str._02X
mov edx, eax
mov rcx, rdi
call fcn.140053d10
sub r15, 1
jne 0x140054d10
mov r15, qword [rsp + 0x58]
movsxd rsi, esi
test rsi, rsi
jle 0x140054d6e
nop word [rax + rax]
movzx edx, byte [rbx + rbp]
lea r8, str._02X
xor edx, r14d
mov rcx, rdi
call fcn.140053d10
inc rbx
cmp rbx, rsi
jl 0x140054d50
xor r14d, r12d
lea r8, str._02X
mov edx, r14d
mov rcx, rdi
call fcn.140053d10
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140055110
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005533f
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov r12, rcx
movsxd rsi, edx
mov rcx, qword [r8]
mov rdi, r9
mov qword [rsp + 0x78], r14
mov rbx, r8
test rcx, rcx
je 0x140055141
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r14d, r14d
mov qword [rbx], r14
mov qword [rbx + 8], r14
test r12, r12
je 0x140055331
cmp esi, 1
jl 0x140055331
mov qword [rsp + 0x60], rbp
mov ebp, r14d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x30], r15
mov r15, rsi
mov qword [rsp + 0x20], r12
test rdi, rdi
je 0x140055200
cmp byte [rdi], bpl
je 0x140055200
test esi, esi
js 0x1400551a3
mov eax, r14d
lea eax, [rsi + 0x400]
and eax, 0xfffffc00
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
mov byte [rsi + rbp], r14b
mov r8d, r14d
mov qword [rsp + 0x20], rbp
test esi, esi
jle 0x140055200
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx], r8b
jne 0x1400551b7
movsxd r10, ecx
mov rdx, rbp
mov rcx, r14
sub r12, rbp
mov r9, r15
nop
movzx eax, byte [r12 + rdx]
lea rdx, [rdx + 1]
xor al, byte [rcx + rdi]
inc rcx
mov byte [rdx - 1], al
cmp rcx, r10
lea eax, [r8 + 1]
mov r8d, r14d
cmovl r8d, eax
mov rax, r14
cmovl rax, rcx
mov rcx, rax
sub r9, 1
jne 0x1400551d0
mov edx, 0xff
mov ecx, 1
call fcn.140054860
mov edi, dword [rbx + 8]
mov rcx, rbx
inc edi
mov r12d, eax
mov edx, edi
call fcn.1400544f0
movsxd rcx, dword [rbx + 8]
add rcx, qword [rbx]
movsxd rdx, edi
mov byte [rcx], r12b
mov rcx, qword [rbx]
mov dword [rbx + 8], edi
mov byte [rdx + rcx], r14b
mov edx, 0xa
lea ecx, [rdx - 8]
call fcn.140054860
mov r13d, eax
mov dword [rsp + 0x70], r13d
cmp eax, 1
jl 0x1400552a5
nop dword [rax]
nop word [rax + rax]
mov edx, 0xff
mov ecx, 1
call fcn.140054860
mov edi, dword [rbx + 8]
mov esi, eax
inc edi
mov rcx, rbx
mov edx, edi
xor sil, r12b
call fcn.1400544f0
movsxd rcx, dword [rbx + 8]
add rcx, qword [rbx]
mov byte [rcx], sil
mov rax, qword [rbx]
movsxd rcx, edi
mov dword [rbx + 8], edi
mov byte [rcx + rax], r14b
sub r13, 1
jne 0x140055260
mov r13d, dword [rsp + 0x70]
test r15, r15
jle 0x1400552eb
mov r13, qword [rsp + 0x20]
nop
mov edi, dword [rbx + 8]
mov rcx, rbx
movzx esi, byte [r14 + r13]
inc edi
mov edx, edi
xor sil, r12b
call fcn.1400544f0
movsxd rax, dword [rbx + 8]
inc r14
add rax, qword [rbx]
movsxd rcx, edi
mov byte [rax], sil
mov rax, qword [rbx]
mov dword [rbx + 8], edi
mov byte [rcx + rax], 0
cmp r14, r15
jl 0x1400552b0
mov r13d, dword [rsp + 0x70]
mov edi, dword [rbx + 8]
mov rcx, rbx
inc edi
xor r13b, r12b
mov edx, edi
call fcn.1400544f0
movsxd rax, dword [rbx + 8]
add rax, qword [rbx]
mov r15, qword [rsp + 0x30]
movsxd rcx, edi
mov byte [rax], r13b
mov rax, qword [rbx]
mov r13, qword [rsp + 0x68]
mov dword [rbx + 8], edi
mov byte [rcx + rax], 0
test rbp, rbp
je 0x14005532c
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140055340
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140055558
mov qword [rsp + 0x18], r8
push rbx
push rsi
push r12
push r15
sub rsp, 0x48
mov r12, rcx
mov r15, r9
mov rcx, qword [r8]
mov rsi, r8
mov ebx, edx
test rcx, rcx
je 0x140055371
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
mov qword [rsi], r9
mov qword [rsi + 8], r9
test r12, r12
je 0x14005554e
cmp ebx, 3
jl 0x14005554e
movzx r8d, byte [r12]
lea eax, [rbx - 1]
mov qword [rsp + 0x70], rbp
lea r12, [r12 + 1]
mov qword [rsp + 0x78], rdi
mov ebp, r9d
movsxd rcx, eax
mov edi, r9d
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x28], r9
movzx edx, byte [rcx + r12 - 1]
lea ecx, [rbx - 2]
xor edx, r8d
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x38], 0x400
mov dword [rsp + 0x20], r8d
jbe 0x1400553e6
mov eax, edx
add r12, rax
sub ecx, edx
movsxd r13, ecx
mov r14, r9
test ecx, ecx
jle 0x140055441
mov esi, dword [rsp + 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx ebx, byte [r14 + r12]
lea rcx, [rsp + 0x28]
xor bl, sil
inc edi
mov edx, edi
call fcn.1400544f0
movsxd rax, dword [rsp + 0x30]
inc r14
mov rbp, qword [rsp + 0x28]
mov dword [rsp + 0x30], edi
mov byte [rax + rbp], bl
movsxd rax, edi
mov byte [rax + rbp], 0
cmp r14, r13
jl 0x140055400
mov rsi, qword [rsp + 0x80]
xor r9d, r9d
test r15, r15
je 0x1400554f2
cmp byte [r15], 0
je 0x1400554f2
movsxd rax, edi
mov r13d, r9d
mov qword [rsp + 0x20], rax
test edi, edi
jle 0x140055529
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140055470
movsxd rcx, eax
mov r12, r9
mov qword [rsp + 0x80], rcx
mov r14, r9
nop dword [rax + rax]
mov ebx, dword [rsi + 8]
mov rcx, rsi
movzx edi, byte [r12 + rbp]
inc ebx
xor dil, byte [r14 + r15]
mov edx, ebx
call fcn.1400544f0
movsxd rax, dword [rsi + 8]
inc r14
add rax, qword [rsi]
inc r12
movsxd rcx, ebx
mov byte [rax], dil
mov rax, qword [rsi]
mov dword [rsi + 8], ebx
mov byte [rcx + rax], 0
lea eax, [r13 + 1]
xor r13d, r13d
cmp r14, qword [rsp + 0x80]
cmovl r13d, eax
xor eax, eax
cmp r14, qword [rsp + 0x80]
cmovl rax, r14
mov r14, rax
cmp r12, qword [rsp + 0x20]
jl 0x140055490
jmp 0x140055529
test rbp, rbp
je 0x140055537
test edi, edi
jle 0x140055529
mov ebx, dword [rsi + 8]
mov rcx, rsi
add ebx, edi
mov edx, ebx
call fcn.1400544f0
movsxd rcx, dword [rsi + 8]
mov rdx, rbp
add rcx, qword [rsi]
movsxd r8, edi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi]
movsxd rdx, ebx
mov dword [rsi + 8], ebx
mov byte [rdx + rax], 0
test rbp, rbp
je 0x140055537
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rsi
pop rbx
ret
Function at 0x140055560
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x1400f7008]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, r8
mov rbx, rcx
mov r8d, 0x800
lea rcx, [rsp + 0x30]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], 0x7ff
mov rdx, rdi
lea rcx, str.type
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [rsp + 0x30], 0
jne 0x1400555c7
xor eax, eax
jmp 0x140055641
lea rdx, str.TRUE
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400555e4
mov eax, 1
jmp 0x140055641
lea rdx, [0x1400e5538]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400555dd
lea rdx, [0x1400ddf3c]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400555dd
lea rdx, [0x1400e5544]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400555dd
lea rdx, [0x1400ddeb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400bdec0
mov rbx, qword [rsp + 0x858]
add rsp, 0x840
pop rdi
ret
Function at 0x140066b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.140055c00
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140066ba6
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x140066bfd
mov ebp, 0x4b0000
jmp 0x140066c0b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.140058040
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140066c21
mov eax, r12d
jmp 0x140066c2a
mov edx, edi
mov ecx, ebp
call fcn.140058040
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140066c46
shl esi, 0x10
mov ecx, esi
jmp 0x140066d35
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140066ca4
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.140055c00
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140066c94
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140057f10
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.140055c00
add ebx, eax
jmp 0x140066d3e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140066cb1
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140066cf0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.140055c00
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140066cf5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140057f10
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.140055c00
add ebx, eax
jmp 0x140066d3e
cmp eax, r12d
jge 0x140066d2e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.140055c00
sub ebp, eax
sub r15d, esi
je 0x140066d2e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140057f10
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.140055c00
add ebx, eax
jmp 0x140066d3e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.140055c00
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.140055c00
Function at 0x1400b2cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x1400f7008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400b2e6c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400b2e6c
cmp r10d, r14d
jne 0x1400b2d70
sub rbx, 0x10
jmp 0x1400b2eb4
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400b2de2
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400b2da4
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400b2dac
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400b2dcb
movzx edx, r11b
mov rcx, rsi
call fcn.1400b3e80
test al, al
jne 0x1400b2ec5
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400b44f0
test al, al
jne 0x1400b2ec5
mov edx, dword [rsi + 0x64]
lea r9, [0x1400b4850]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400b2e0e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400b2b50
jmp 0x1400b2e62
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400b2b50
test dil, dil
je 0x1400b2e5a
cmp byte [rsi + 0x6a], 0
jne 0x1400b2e5a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400b2ec5
sub rbx, 0x10
jmp 0x1400b2eb4
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400b2ec9
mov ebp, dword [rbx]
jmp 0x1400b2d30
mov al, 1
jmp 0x1400b2ed2
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400bdec0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400ba1d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400ba1db
xor eax, eax
ret
lea r11, [0x1400dd160]
not ecx
cmp r8d, 8
jb 0x1400ba2b1
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400ba200
test r8d, r8d
je 0x1400ba2dd
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400ba2c0
not ecx
mov eax, ecx
ret
Function at 0x1400110fa
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
jmp 0x140014390
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x1400290f5]
call fcn.14001164f
mov qword [rbp + 8], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400115e1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov edx, 0x1388
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400234c0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [0x1400234c8], 2
jae 0x140014405
xor eax, eax
jmp 0x14001440a
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1400111c7
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140014040
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1400290f5]
call fcn.14001164f
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.14001132a
mov qword [rbp + 0x288], rax
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.140011410
mov dword [rbp + 0x2a4], 1
mov dword [rbp + 0x2c4], 0
mov eax, dword [rbp + 0x2a4]
inc eax
mov dword [rbp + 0x2a4], eax
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x2e8]
call fcn.140011221
lea rdx, str.WeChat.exe
lea rcx, [rbp + 0x2e8]
call fcn.14001123a
movzx eax, al
test eax, eax
je 0x140014104
mov dword [rbp + 0x2c4], 1
lea rcx, [rbp + 0x2e8]
call fcn.1400115aa
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.1400115af
test eax, eax
jne 0x1400140c2
cmp dword [rbp + 0x2c4], 0
jne 0x140014133
xor eax, eax
jmp 0x14001415b
cmp dword [rbp + 0x2a4], 0xc8
jle 0x14001414b
mov dword [rbp + 0x494], 1
jmp 0x140014155
mov dword [rbp + 0x494], 0
mov eax, dword [rbp + 0x494]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ef90]
call fcn.140011569
mov rax, rdi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.140011343
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret

Function at 0x1400113b1
Capabilities:
Terminate process

Disassembly:
jmp 0x140017160
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret