joyce8/EMBER2024-capa huggingface dataset:
Function at 0x142243058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1422431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142243089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14224306f
add dl, dl
jne 0x142243096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422430f6
xor eax, eax
add dl, dl
jne 0x1422430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422431ad
add dl, dl
jne 0x1422430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1422430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14224307e
mov eax, 1
add dl, dl
jne 0x142243106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142243113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1422430fb
sub eax, ebx
mov ebx, 1
jne 0x14224314c
mov ecx, 1
add dl, dl
jne 0x14224312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14224313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142243123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14224307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142243168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142243175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14224315d
cmp eax, 0x7d00
jae 0x14224319b
cmp eax, 0x500
jb 0x142243196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14224307e
cmp eax, 0x7f
ja 0x14224319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14224307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1422431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14224307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a5b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140010050
cmp rax, 1
jne 0x14000a5e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a58d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a580
cmp rcx, 1
jb 0x14000a5e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a550
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c4f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fd14
int3
Function at 0x14000a670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6b5
xor al, al
jmp 0x14000a702
cmp word [rbx], 0
je 0x14000a6cd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6c0
cmp word [rsp + 0x30], 0
je 0x14000a6fb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a723
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6e0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c4f0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fd14
int3
Function at 0x14000cde4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ce2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ce2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ce2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ce2e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ce2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ce30
xor al, al
add rsp, 0x28
ret

Function at 0x14000fb04
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb73
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb73
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb73
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb73
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb73
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb73
cmp dword [rcx + 0xf8], 0
je 0x14000fb73
mov ecx, ebx
call fcn.14000fc24
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fa00
nop
cmp dword [rbp + 0x20], 0
je 0x14000fbc1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fbcc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fb04

Function at 0x14000fd08
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb73
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb73
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb73
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb73
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb73
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb73
cmp dword [rcx + 0xf8], 0
je 0x14000fb73
mov ecx, ebx
call fcn.14000fc24
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fa00
nop
cmp dword [rbp + 0x20], 0
je 0x14000fbc1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fbcc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fb04
Function at 0x140019118
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001919f
mov rsi, rbx
cmp word [rax], bp
je 0x14001915e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019148
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019144
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016948
mov rdi, rax
test rax, rax
je 0x14001918c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fd30
mov rbp, rdi
xor ecx, ecx
call fcn.140015a58
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b30c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b322
mov al, 1
jmp 0x14001b382
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b333
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b380
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019460
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b380
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b380
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b380
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b382
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f5a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f5c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f5c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140013360
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146d0
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146e3
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001470d
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014721
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014733
xor al, al
jmp 0x140014751
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001474f
xor al, al
jmp 0x140014751
mov al, 1
add rsp, 0x38
ret
Function at 0x14000306c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400030b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400030b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400030b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400030b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400030b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400030b8
xor al, al
add rsp, 0x28
ret
Function at 0x1800028c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
mov eax, 0x64
lea rdi, [rsp + 0x58]
add eax, 2
mov edx, 1
movsxd rcx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.18000b920
mov rbx, rax
call fcn.180003be0
mov r9, qword [rsp + 0x50]
mov r8d, 0x65
mov qword [rsp + 0x28], rdi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
or rcx, 2
call fcn.180010d7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
call fcn.1800110e4
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x180002950
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180031df0]
cmp qword [0x180031de8], 0
jne 0x1800029cb
cmp rax, 0x3e8
jae 0x180002994
lea rcx, str.Reconnect_cooldown_n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800028c0
lea rcx, str.Socket_gone__restarting_n
call fcn.1800028c0
lea r9, [0x180031dd0]
call fcn.1800041a0
test eax, eax
jne 0x1800029c6
lea rcx, str.Error_connecting_to_websocket_n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800028c0
call fcn.180003320
lea rcx, str.Sending_message_on_websocket_n
call fcn.1800028c0
mov rcx, qword [0x180031de8]
mov r9d, ebx
mov r8, rdi
mov edx, 2
call qword [sym.imp.WINHTTP.dll_WinHttpWebSocketSend]
test eax, eax
je 0x180002a72
lea rcx, str.Error_sending__cleaning_up_connection_n
call fcn.180003ce0
mov rcx, qword [0x180031de0]
xor ebx, ebx
test rcx, rcx
je 0x180002a1a
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [0x180031de0], rbx
mov rcx, qword [0x180031de8]
test rcx, rcx
je 0x180002a33
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [0x180031de8], rbx
mov rcx, qword [0x180031dd8]
test rcx, rcx
je 0x180002a4c
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [0x180031dd8], rbx
mov rcx, qword [0x180031dd0]
test rcx, rcx
je 0x180002a65
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [0x180031dd0], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180031df0], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180003940
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp dword [0x180031db0], 0
jne 0x18000395d
lea rcx, str.Unloading_DLL_but_hook_was_never_installed_n
add rsp, 0x28
jmp fcn.1800028c0
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [0x180031db4], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.180003bf0
mov rbx, rax
call fcn.180006600
mov edx, eax
lea rcx, str.DetourTransactionBegin:__08X_n
call fcn.1800028c0
mov rdi, rbx
test rbx, rbx
je 0x1800039c6
nop dword [rax]
mov rcx, qword [rdi]
call fcn.180006b20
mov r8, qword [rdi]
lea rcx, str.DetourUpdateThread:__d__08X__08X_n
mov edx, dword [rdi + 8]
mov r9d, eax
call fcn.1800028c0
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x1800039a0
lea rdx, [0x1800030c0]
lea rcx, [0x180031d98]
call fcn.180006260
mov edx, eax
lea rcx, str.ProcessNetworkManager_detach:__08X_n
call fcn.1800028c0
lea rdx, [0x180003190]
lea rcx, [0x180031d90]
call fcn.180006260
mov edx, eax
lea rcx, str.LoadTableArea_detach:__08X_n
call fcn.1800028c0
lea rdx, [0x180003230]
lea rcx, [0x180031d88]
call fcn.180006260
mov edx, eax
lea rcx, str.UpdateAmountsFormatInfo_detach:__08X_n
call fcn.1800028c0
call fcn.180006670
mov edx, eax
lea rcx, str.DetourTransactionCommit:__08X_n
call fcn.1800028c0
test rbx, rbx
je 0x180003a53
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180003a41
lea rcx, str.Unhook_complete_n
call fcn.1800028c0
mov rcx, qword [0x180031da0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, str.Waiting_for_websocket_thread_to_exit_n
call fcn.1800028c0
mov rcx, qword [0x180031da8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
test eax, eax
je 0x180003aad
lea rcx, str.ERROR_websocketThread_did_not_exit_cleanly_n
call fcn.1800028c0
lea rcx, str.not_cleaning_up_message_queue_n
call fcn.1800028c0
jmp 0x180003b3e
lea rcx, str.Cleaning_up_message_queue_n
call fcn.1800028c0
mov rbx, qword [0x180031db8]
test rbx, rbx
je 0x180003b31
mov rcx, qword [0x180031dc8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x180031db8]
mov rax, qword [rcx + 8]
mov rbx, qword [rcx]
mov qword [0x180031db8], rax
test rax, rax
jne 0x180003af8
mov qword [0x180031dc0], rdi
call fcn.1800110e4
mov rcx, qword [0x180031dc8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call fcn.1800110e4
mov rbx, qword [0x180031db8]
test rbx, rbx
jne 0x180003ac5
jmp 0x180003b31
mov rcx, qword [0x180031dc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Done_n
call fcn.1800028c0
mov rbx, qword [rsp + 0x30]
mov dword [0x180031db0], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180003bf0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov ecx, 4
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180003cc0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180003cb7
mov qword [rsp + 0x60], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x180003c98
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180003c98
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180003c98
mov edx, 0x18
mov ecx, 1
call fcn.18000b920
mov rbx, rax
xor edx, edx
mov eax, dword [rsp + 0x28]
mov ecx, 0x5a
mov dword [rbx + 8], eax
mov r8d, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbx + 0x10], rsi
mov rsi, rbx
mov qword [rbx], rax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180003c44
mov rbx, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180008070
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180003d90
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1080
call fcn.1800213e0
sub rsp, rax
mov rax, qword [0x180030040]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000000
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov r9d, 0x18
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180003f67
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x180003f67
lea rdx, [0x18002ca3c]
mov rcx, rdi
call fcn.180011ef0
mov rdi, rax
test rax, rax
je 0x180003f67
mov r9, rax
lea rcx, [rsp + 0x70]
mov edx, 1
mov r8d, 0x1000
call fcn.18001230c
test eax, eax
je 0x180003e8a
nop dword [rax]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x180003f47
mov r9, rdi
lea rcx, [rsp + 0x70]
mov edx, 1
mov r8d, 0x1000
call fcn.18001230c
test eax, eax
jne 0x180003e50
mov rcx, rdi
call fcn.1800124f8
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x30], 0x20
mov edx, 2
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x180003f4f
mov qword [rsp + 0x1098], rbp
lea rbp, [0x180031f40]
cmp dword [rsp + 0x30], ebx
jbe 0x180003f22
mov qword [rsp + 0x10a0], rsi
mov edi, ebx
lea rsi, [rsp + 0x48]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rsi]
lea r8, str._02x
movsxd rcx, edi
mov edx, 3
add rcx, rbp
call fcn.180004140
inc ebx
lea rsi, [rsi + 1]
add edi, 2
cmp ebx, dword [rsp + 0x30]
jb 0x180003ef0
mov rsi, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, rbp
mov rbp, qword [rsp + 0x1098]
jmp 0x180003f69
mov rcx, rdi
call fcn.1800124f8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.180008070
mov rbx, qword [rsp + 0x10a8]
add rsp, 0x1080
pop rdi
ret
Function at 0x180003f90
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov rdi, rcx
movaps xmm1, xmmword [0x18002ca60]
lea rcx, [rdx + 2]
movaps xmmword [rax - 0x58], xmm0
mov rbx, rdx
movaps xmm0, xmmword [0x18002ca70]
movabs r14, 0xaaaaaaaaaaaaaaab
movaps xmmword [rax - 0x48], xmm1
movaps xmm1, xmmword [0x18002ca80]
movaps xmmword [rax - 0x38], xmm0
movaps xmmword [rax - 0x28], xmm1
movzx eax, byte [0x18002ca90]
mov byte [rsp + 0x60], al
mov rax, r14
mul rcx
mov rax, 0xffffffffffffffff
mov rbp, rdx
mov edx, 1
shr rbp, 1
shl rbp, 2
mov rcx, rbp
add rcx, 1
cmovb rcx, rax
call fcn.18000b920
mov rsi, rax
test rax, rax
je 0x180004117
xor eax, eax
test rbx, rbx
je 0x1800040d0
mov r10, rsi
cmp rax, rbx
jae 0x18000406d
movzx edx, byte [rax + rdi]
lea rcx, [rax + rdi]
inc rax
cmp rax, rbx
jae 0x18000406f
movzx r9d, byte [rax + rdi]
lea rcx, [rax + rdi]
inc rax
mov r8, rax
cmp rax, rbx
jae 0x180004072
movzx ecx, byte [r8 + rdi]
inc rax
jmp 0x180004074
xor edx, edx
xor r9d, r9d
xor ecx, ecx
shl rdx, 8
add rdx, r9
shl rdx, 8
add rdx, rcx
mov rcx, rdx
shr rcx, 0x12
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r10], cl
mov rcx, rdx
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r10 + 1], cl
mov rcx, rdx
shr rcx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [rsp + rcx + 0x20]
mov byte [r10 + 2], cl
movzx ecx, byte [rsp + rdx + 0x20]
mov byte [r10 + 3], cl
add r10, 4
cmp rax, rbx
jb 0x18000403f
mov rax, r14
mul rbx
mov rax, r14
shr rdx, 1
inc rdx
lea r9, [rdx + rdx*2]
sub r9, rbx
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
je 0x180004110
lea rcx, [rbp - 1]
mov r8, r9
add rcx, rsi
mov dl, 0x3d
sub rcx, r9
inc rcx
call fcn.180021cd0
nop dword [rax]
mov byte [rsi + rbp], 0
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret