joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ef10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x160
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rsi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14001ef54
xor eax, eax
jmp 0x14001f045
mov qword [rsp + 0x170], rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov qword [rsp + 0x178], rdi
call sub.KERNEL32.dll_Process32First
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001ef80
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jb 0x14001ef9a
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001efbd
cmp rdi, rbx
jb 0x14001efbd
jbe 0x14001f066
lea rdx, [rsp + 0x20]
mov rcx, rbp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x14001f02a
nop
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14001efe0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov rdi, qword [rsi + 0x10]
jb 0x14001effa
mov rcx, qword [rsi]
cmp rbx, rdi
lea rdx, [rsp + 0x4c]
mov r8, rdi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f019
cmp rdi, rbx
jb 0x14001f019
jbe 0x14001f066
lea rdx, [rsp + 0x20]
mov rcx, rbp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14001efd0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140102810
mov rbp, qword [rsp + 0x180]
add rsp, 0x160
pop rsi
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14001f035
Function at 0x14001f5d0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov qword [rsp + 0x38], rsp
mov dword [r11 - 0x38], 0x95889c93
mov dword [r11 - 0x34], 0xcdcd9199
mov dword [r11 - 0x30], 0x6f6e652e
mov word [r11 - 0x2c], 0x100
xor esi, esi
mov ecx, esi
nop dword [rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x290], al
inc rcx
cmp rcx, 0xc
jb 0x14001f620
mov byte [rsp + 0x29d], sil
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movdqa xmm0, xmmword [0x14010b550]
movdqu xmmword [rsp + 0x2a0], xmm0
mov word [rsp + 0x2b0], 0x7c
mov byte [rsp + 0x2b2], 1
mov rdx, rsi
nop
lea ecx, [rdx - 8]
xor byte [rsp + rdx + 0x2a0], cl
inc rdx
cmp rdx, 0x11
jb 0x14001f670
mov byte [rsp + 0x2b2], sil
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x290], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
nop
mov r8d, dword [rsp + 0x58]
cmp eax, r8d
jne 0x14001f6fb
lea rdx, [0x14001f768]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001f726
lea rdx, [0x14001f768]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14001f757
lea rdx, [0x14001f768]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll__local_unwind
mov eax, dword [rdi]
cmp dword [rsp + 0x30], eax
jne 0x14001f7c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14001f78e
xor esi, esi
mov rdi, qword [rsp + 0x290]
mov eax, dword [rsp + 0x34]
jmp 0x14001f6e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001f79e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140102810
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140022bb0
nop
int3
Function at 0x140021890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov dword [rbp - 0x30], 0x979e8d96
mov ecx, ebx
mov dword [rbp - 0x2c], 0x939ad390
mov word [rbp - 0x28], WSAGetLastError
mov byte [rbp - 0x26], 1
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 9
jb 0x1400218d0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x14010b560]
mov rcx, rax
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6e78615c
mov dword [rbp - 0xc], 0x100696d
nop dword [rax + rax]
lea eax, [rbx - 8]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x16
jb 0x140021910
lea rdx, [rbp - 0x20]
mov byte [rbp - 9], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x11]
call rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140102810
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140021c20
Capabilities:
Encode data using xor
Hide thread from debugger

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edi, edi
mov dword [rsp + 0x20], 0x979e8d96
mov eax, edi
mov dword [rsp + 0x24], 0x939ad390
mov word [rsp + 0x28], WSAGetLastError
mov byte [rsp + 0x2a], 1
nop dword [rax]
lea ecx, [rax - 8]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 9
jb 0x140021c60
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2a], dil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x11]
call rbx
test eax, eax
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140102810
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140022530
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movdqa xmm0, xmmword [0x14010b610]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14010b530]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x14010b4a0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x14010b410]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x14010b2f0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14010b260]
movdqa xmmword [r11 - 0x38], xmm1
mov dword [r11 - 0x28], 0x287f2a7d
mov dword [r11 - 0x24], 0x2c7b2e79
mov dword [r11 - 0x20], 0x10471245
mov dword [r11 - 0x1c], 0x1001641
xor eax, eax
mov qword [rsp + 0x20], rax
cmp rax, 0x6e
jae 0x1400225dd
lea ecx, [rax - 8]
xor cl, byte [rsp + rax + 0x30]
mov byte [rsp + rax + 0x30], cl
inc rax
jmp 0x1400225c2
mov byte [rsp + 0x9f], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1400225f2
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140102810
add rsp, 0xb8
ret
Function at 0x140022e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140022e83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x140022e70
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x140022e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x140022eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x140022ea0
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x140022ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140022ee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x140022ed0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x140022ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140022f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140022f00
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x140022f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140022f43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140022f30
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140022f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x140022f73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140022f60
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x140022f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140022fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140022f90
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140022fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140022fd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x140022fc0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x140022fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140023003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140022ff0
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140023010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140023033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x140023020
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x140023040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x140023063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140023050
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret
Function at 0x140023070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x140023093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x140023080
mov byte [rcx + 0x1f], 0
mov rax, rcx
ret

Function at 0x1400230a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x1400230c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x1400230b0
mov byte [rcx + 0x21], 0
mov rax, rcx
ret

Function at 0x1400230d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x1400230f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x1400230e0
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x140023100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x65], 0
je 0x140023123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x64
jb 0x140023110
mov byte [rcx + 0x65], 0
mov rax, rcx
ret

Function at 0x140023130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140023153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 8]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140023140
mov byte [rcx + 0xe], 0
mov rax, rcx
ret
Function at 0x140023bc0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov dword [rbp - 0x49], 0xa7d4a5a4
mov ecx, edi
mov dword [rbp - 0x45], 0x8b8d9997
mov dword [rbp - 0x41], 0x66696f69
mov word [rbp - 0x3d], 0x76
mov byte [rbp - 0x3b], 1
nop dword [rax + rax]
lea eax, [rcx - 8]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0xd
jb 0x140023c10
lea rax, [rbp - 0x49]
mov dword [rbp - 0x49], 0xa7d4a5a4
mov qword [rbp + 0x37], rax
mov rcx, rdi
mov dword [rbp - 0x45], 0x98b994b2
mov dword [rbp - 0x41], 0x1007345
lea eax, [rcx - 8]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0xa
jb 0x140023c40
lea rax, [rbp - 0x49]
mov dword [rbp - 0x49], 0xa7d4a5a4
mov qword [rbp + 0x3f], rax
mov rcx, rdi
mov dword [rbp - 0x45], 0x8aba8eb7
mov dword [rbp - 0x41], 0x7167716d
mov word [rbp - 0x3d], 0x100
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0xc
jb 0x140023c80
lea rax, [rbp - 0x49]
mov rbx, rdi
mov qword [rbp + 0x47], rax
nop dword [rax + rax]
mov rcx, qword [rbp + rbx*8 + 0x37]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140023cfc
inc rbx
cmp rbx, 3
jl 0x140023ca0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140102810
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
movdqa xmm0, xmmword [0x14010b430]
lea rcx, [rbp - 0x39]
movdqa xmm1, xmmword [0x14010b420]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x14010b490]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x14010b6a0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x14010b250]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x14010b640]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x372f3766
mov word [rbp + 0x2b], 0x100
call fcn.140023100
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140022bb0
int3
Function at 0x1400252d0
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [rsp + 0x20], 0x88919c94
mov word [rsp + 0x24], 0x9d
mov byte [rsp + 0x26], 1
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 8]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 5
jb 0x140025310
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002534c
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140102810
add rsp, 0x38
ret
call fcn.140022bb0
int3
Function at 0x140025d90
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14006b3d8
call fcn.14006b380
call fcn.14006b3ee
call fcn.14006b380
call fcn.14006b3ac
call fcn.14006b396
call fcn.14006b3ac
call fcn.14006b396
call fcn.14006b3c2
call fcn.14001e030
call fcn.14001dcc0
call fcn.140024400
call fcn.14001dbb0
call fcn.14001d8c0
call fcn.14001dab0
call fcn.140023bc0
call fcn.1400252d0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140025f41
call fcn.14001fe60
call fcn.14001fde0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140025f41
call fcn.140021890
call fcn.14001d200
call fcn.14001f5d0
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rdx, str.Immunity_Debugger____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140025f1b
test rbx, rbx
jne 0x140025f1b
call fcn.1400226c0
call fcn.140022610
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
ja 0x140025f41
call fcn.140022530
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140025f47
call fcn.140024350
test al, al
jne 0x140025f64
call fcn.140021c20
test eax, eax
jne 0x140025f81
call fcn.140023160
test eax, eax
jne 0x140025f9e
call fcn.140021970
test eax, eax
jne 0x140025f24
mov qword [rsp + 0x20], 0x3e8
lea rcx, [rsp + 0x20]
call fcn.1400199a0
call fcn.14006b3ee
call fcn.14006b380
call fcn.14006b3d8
call fcn.14006b396
call fcn.14006b3ac
call fcn.14006b380
call fcn.14006b3c2
call fcn.14006b396
call fcn.14006b3ac
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140102810
add rsp, 0x50
pop rbx
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Debugger_Detected._Restart_computer
lea rcx, [rsp + 0x28]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x28]
call fcn.140025710
nop
call fcn.140022bb0
int3
lea rdx, str.Debugger_Detected
lea rcx, [rsp + 0x28]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x28]
call fcn.140025710
nop
lea rdx, str.Check_failed._Reopen
lea rcx, [rsp + 0x28]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x28]
call fcn.140025710
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x28]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x28]
call fcn.140025710
nop
lea rdx, str.Debugging_Detected
lea rcx, [rsp + 0x28]
call fcn.1400085c0
nop
lea rcx, [rsp + 0x28]
call fcn.140025710
int3
Function at 0x14002f9d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401cea50]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401cfa08]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1f4d], 0
jne 0x14002fa37
cmp byte [rbx + 0x1f4e], 0
jne 0x14002fa37
mov r9d, dword [rbx + 0x3028]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400340e0
test sil, 1
je 0x14002fb66
jmp 0x14002facf
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14010b054]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x14010b03c]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
or dword [rbx + 0x1cb0], 1
mov qword [rbx + 0x1cc8], rax
movss dword [rbx + 0x1cc0], xmm0
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mov rax, qword [0x1401cfa08]
mulss xmm0, dword [0x14010bf04]
or dword [rax + 0x1cb0], 0x40
movss dword [rax + 0x1d10], xmm0
mov r9d, dword [rbx + 0x3028]
call fcn.1400340e0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14002fb20
lea r11, [0x14010b710]
nop
cmp r9b, 0x23
jne 0x14002fb03
cmp byte [r8], r9b
jne 0x14002fb03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14002faf0
not ecx
call fcn.140032cd0
test rax, rax
je 0x14002fb66
cmp byte [rax + 0x8e], 0
je 0x14002fb66
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3028]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3028]
call fcn.1400340e0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.14002cdc0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140102810
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140033690
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0xc8]
mov r9, r8
mov r8, qword [rcx + 0xd0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.140034230
Function at 0x140033e30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x140033e4b
mov qword [r8], 0
call fcn.140033f90
mov rbx, rax
test rax, rax
jne 0x140033e61
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140033f69
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140033f69
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140033f69
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140033f69
cmp rdi, 0xffffffffffffffff
je 0x140033f69
mov rax, qword [0x1401cfa08]
test rax, rax
je 0x140033ee2
inc dword [rax + 0x3b4]
mov rdx, qword [0x1401cfa18]
lea rcx, [rdi + rbp]
call qword [0x1401a3820]
mov rsi, rax
test rax, rax
je 0x140033f69
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x140033f41
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401cfa08]
test rax, rax
je 0x140033f2f
dec dword [rax + 0x3b4]
mov rdx, qword [0x1401cfa18]
mov rcx, rsi
call qword [0x1401a3828]
jmp 0x140033f72
test ebp, ebp
jle 0x140033f53
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140033f64
mov qword [r14], rdi
mov rax, rsi
jmp 0x140033f74
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x140034230
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14003428d
lea rbx, [0x14010b710]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140034274
cmp r10, 2
jb 0x140034274
cmp byte [r9], r8b
jne 0x140034274
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140034250
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400342cf
lea rbx, [0x14010b710]
cmp r8b, 0x23
jne 0x1400342b3
cmp byte [r9], r8b
jne 0x1400342b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400342a0
mov rbx, qword [rsp + 8]
not eax
ret