joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c360
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov byte [rcx], 0
mov rdi, rcx
call qword [sym.imp.WS2_32.dll_gethostname]
lea edx, [rbx - 1]
movsxd r8, edx
mov byte [r8 + rdi], 0
test eax, eax
jne 0x14006c39d
lea edx, [rax + 0x2e]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x14006c39b
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006d4b0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14006d4d0
test rbx, rbx
je 0x14006d4ea
lea rcx, [rbx + rbx]
call qword [section..data]
jmp 0x14006d4f7
lea rcx, [0x140088e31]
call qword [str.vl_a_]
mov rdi, rax
test rax, rax
jne 0x14006d507
lea eax, [rdi + 0x1b]
jmp 0x14006d5c3
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14006d5e0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14006d5b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14006d5a3
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [0x1400a3008]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14006d610
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400a30d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14006d6e1
xor eax, eax
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x58], rax
mov rcx, rsi
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.14006d760
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.14006fe50
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 0x14]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x14006d6e5
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x14006d72f
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140070190
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14006ff20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14006ff62
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14006ffa5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140070002
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14006ffc0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140070043
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140087eca]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140087ecb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140070010
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140074510
Capabilities:
Copy file

Disassembly:
xor r9d, r9d
xor r8d, r8d
jmp 0x140074510
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov eax, r8d
mov rsi, rdx
mov rdi, rcx
jb 0x140074535
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14007453f
mov rcx, qword [rcx]
xor r8d, r8d
test eax, eax
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140074588
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140074588
lea rcx, str.boost::filesystem::copy_file
mov r9, rbx
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov ecx, eax
mov rdx, rdi
call fcn.140076790
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400745a0
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140074d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x140074d5f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140074d8e
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140074bd0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x140074da6
mov dword [rsi], 0
mov byte [rsi + 4], 0
call fcn.140075220
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x140074ded
mov rcx, rdi
call fcn.140074790
test al, al
je 0x140074dd8
test bl, 0x10
mov eax, 4
mov ecx, ntohs
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140074e10
Capabilities:
Delete directory
Delete file

Disassembly:
xor edx, edx
jmp 0x140074e10
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0
mov rdi, rcx
mov byte [rsp + 0x24], 0
call fcn.140075220
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, rdi
call fcn.140074d40
mov esi, eax
test eax, eax
jne 0x140074e7b
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x140074e7b
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
call fcn.1400768b0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x140074e93
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov r8, rbx
mov edx, esi
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140074eb0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x140074eec
test rbx, rbx
je 0x140074edf
mov dword [r8], 0
mov byte [r8 + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140074f08
cmp qword [rcx + 0x18], 8
jb 0x140074f00
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140074f18
cmp qword [rcx + 0x18], 8
jb 0x140074f12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140074f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x140074f73
cmp eax, 0x57
je 0x140074f73
cmp eax, 0x35
ja 0x140074f41
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140074f73
cmp eax, 0xa1
je 0x140074f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140074f73
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.1400768b0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140074f8b
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140074eb0
Capabilities:
Delete directory
Delete file

Disassembly:
xor edx, edx
jmp 0x140074e10
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0
mov rdi, rcx
mov byte [rsp + 0x24], 0
call fcn.140075220
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, rdi
call fcn.140074d40
mov esi, eax
test eax, eax
jne 0x140074e7b
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x140074e7b
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
call fcn.1400768b0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x140074e93
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov r8, rbx
mov edx, esi
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140074eb0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x140074eec
test rbx, rbx
je 0x140074edf
mov dword [r8], 0
mov byte [r8 + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140074f08
cmp qword [rcx + 0x18], 8
jb 0x140074f00
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140074f18
cmp qword [rcx + 0x18], 8
jb 0x140074f12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140074f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x140074f73
cmp eax, 0x57
je 0x140074f73
cmp eax, 0x35
ja 0x140074f41
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140074f73
cmp eax, 0xa1
je 0x140074f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140074f73
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.1400768b0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x140074f8b
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140074fa0
Capabilities:
Move file

Disassembly:
xor r8d, r8d
jmp 0x140074fa0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
jb 0x140074fc2
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140074fcc
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140075012
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140075012
lea rcx, str.boost::filesystem::rename
mov r9, rbx
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov ecx, eax
mov rdx, rdi
call fcn.140076790
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14007502a
mov dword [rbx], 0
mov byte [rbx + 4], 0
call fcn.140075220
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140075040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400a30d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x18], 8
jb 0x14007507f
mov rcx, qword [rdx]
jmp 0x140075082
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400750a2
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140074bd0
jmp 0x1400751f6
mov edx, ebp
mov rcx, rsi
call fcn.1400748c0
mov r15d, eax
xor r12d, r12d
bt ebp, 0xa
jae 0x1400751b6
cmp qword [rsi + 0x18], 8
jb 0x1400750c8
mov rdx, qword [rsi]
jmp 0x1400750cb
mov rdx, rsi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp word [rdx], r12w
jne 0x1400750ea
mov r8, r12
jmp 0x1400750fa
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1400750f0
lea rcx, [rsp + 0x50]
call fcn.140003e20
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x14007515f
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140003f80
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp rbx, 0xffffffffffffffff
jne 0x14007518a
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140074bd0
nop
jmp 0x1400751f6
mov rcx, rsi
call fcn.140074790
test al, al
jne 0x1400751ac
mov dword [rdi], 9
mov dword [rdi + 4], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400751f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1400751cc
mov dword [r14], r12d
mov byte [r14 + 4], 0
call fcn.140075220
mov qword [r14 + 8], rax
mov dword [rsp + 0x44], r15d
lea rcx, [rsp + 0x40]
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x1400751ec
mov dword [rsp + 0x40], 2
mov eax, dword [rcx]
mov dword [rdi], eax
mov eax, dword [rcx + 4]
mov dword [rdi + 4], eax
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140070190
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800014c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x180028098]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x34], 0
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x48]
call fcn.180004bf0
lea rdx, [0x18001c460]
lea rcx, [rsp + 0x48]
call fcn.180005660
lea rcx, [rsp + 0x48]
call fcn.180006c30
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.180006a60
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [0x180028c70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x18001c441]
lea rcx, [rsp + 0x68]
call fcn.180004c70
xor eax, eax
cmp eax, 1
je 0x180001640
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x180028c60]
call qword [0x180028c88]
cmp dword [rsp + 0x30], 0
je 0x1800015f3
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov ecx, eax
call fcn.180009fdc
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.180008d00
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x180028c60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x34], 0
jbe 0x180001615
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.180005660
mov rcx, qword [rsp + 0x38]
call fcn.180009fc8
jmp 0x180001628
cmp dword [rsp + 0x30], 0
je 0x180001626
mov rcx, qword [rsp + 0x38]
call fcn.180009fc8
jmp 0x180001640
mov dword [rsp + 0x34], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180001569
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0xa0]
call fcn.180004b90
lea rcx, [rsp + 0x68]
call fcn.180005110
lea rcx, [rsp + 0x48]
call fcn.180005110
mov rcx, qword [rsp + 0xa8]
call fcn.180005110
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180007db0
add rsp, 0x98
ret
Function at 0x180003a70
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
call fcn.180003030
call fcn.1800029a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180003450]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x180007280
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [0x180028098]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 0x20
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
jmp 0x180007314
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
je 0x1800073b1
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x30], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180008d00
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x260]
call fcn.180008d00
mov rax, qword [rsp + 0x30]
mov r8, qword [rax + 0x50]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.18000c2f4
mov r8, qword [rsp + 0x490]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.18000c2f4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call fcn.180007220
test eax, eax
je 0x1800073ac
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
jmp 0x1800073cf
jmp 0x180007307
mov r9d, 0x40
lea r8, [0x18001ca00]
lea rdx, str.Module_notFound
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180007db0
add rsp, 0x480
pop rdi
ret
Function at 0x1800073f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x1800074a2
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x1800074fc
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18000c5c0
test eax, eax
jne 0x1800074fa
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x18000751a
jmp 0x180007498
mov r9d, 0x40
lea r8, str.information
lea rdx, str.address_notFound
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x68
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movabs rax, 0xc2a918b752429231
lea rsi, [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [rsi]
rol rax, 0x1c
movabs rdx, 0x6d6b6a636f775771
sub rax, rdx
xor rax, rdx
rol rax, 0x30
sub rax, rdx
mov qword [rsi], rax
movabs rax, 0xefc09ebdd7e2bae8
lea rdi, [rsp + 0x50]
mov qword [rdi], rax
movabs rax, 0xe443988496e39622
mov qword [rdi + 8], rax
mov rax, qword [rdi]
rol rax, 0x1e
movabs rdx, 0x4751466344646668
sub rax, rdx
xor rax, rdx
rol rax, 0x32
sub rax, rdx
mov qword [rdi], rax
mov rax, qword [rdi + 8]
rol rax, 0x1e
movabs rdx, 0x667764703233674a
sub rax, rdx
xor rax, rdx
rol rax, 0x32
sub rax, rdx
mov qword [rdi + 8], rax
movabs rax, 0xcf0445dcf235d5ec
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
movabs rax, 0xd333e7864ddd44c3
mov qword [rbx + 8], rax
mov rax, qword [rbx]
rol rax, 0x22
movabs rdx, 0x7757506e63457161
sub rax, rdx
xor rax, rdx
rol rax, 0x36
sub rax, rdx
mov qword [rbx], rax
mov rax, qword [rbx + 8]
rol rax, 0x22
mov r14, rcx
movabs rcx, 0x756d6a4f31566b72
sub rax, rcx
xor rax, rcx
rol rax, 0x36
sub rax, rcx
mov qword [rbx + 8], rax
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x30], rdx
mov rax, qword [r14]
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
sub rax, rcx
cmp rax, 0x190
ja 0x140001145
mov rcx, rbx
call fcn.140005d20
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r15, qword [rax + 0x18]
add r15, 0x20
mov r15, qword [r15]
mov rcx, qword [r15 + 0x20]
test rcx, rcx
je 0x14000115a
mov rdx, rdi
call fcn.140001390
test rax, rax
je 0x14000115a
mov edx, 0x1000
mov rcx, r14
call rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r15, qword [rax + 0x18]
add r15, 0x20
mov r15, qword [r15]
mov rcx, qword [r15 + 0x20]
test rcx, rcx
je 0x140001192
mov rdx, rsi
call fcn.140001390
test rax, rax
je 0x140001192
mov ecx, 0xc8
call rax
jmp 0x140001109