joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c7f8
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140129ab8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x70], rdx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c897
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str.Service:_Cannot_install_service___u__n
mov edx, eax
call qword [sym.imp.msvcrt.dll_wprintf_s]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400c9030
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rdi
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000c8ca
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea rcx, str.Service:_OpenSCManager_failed___u__n
jmp 0x14000c867
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x80]
and qword [rsp + 0x58], 0
lea rdx, str.SensorDataService
and qword [rsp + 0x50], 0
mov r9d, 0xf01ff
and qword [rsp + 0x48], 0
mov r8, rdi
and qword [rsp + 0x40], 0
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000c971
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.Service:_CreateService_failed___u__n
call qword [sym.imp.msvcrt.dll_wprintf_s]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test eax, eax
je 0x14000c9ff
jmp 0x14000c875
lea rcx, str.Service:_Installed_successfully_n
call qword [sym.imp.msvcrt.dll_wprintf_s]
nop dword [rax + rax]
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
nop dword [rax + rax]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c9c8
lea rcx, str.Service:_Failed_to_start_n
call qword [sym.imp.msvcrt.dll_wprintf_s]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14000c955
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000dee8
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000dee8
int3
Function at 0x14000fc9c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x140129ab8]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14000fd0d
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14000fd0d
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x14000fceb
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x1400da320]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.14000df38
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000fd83
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14000fe4c
mov edx, 0xc9
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400da264]
call fcn.14000f6d8
mov esi, eax
jmp 0x14000fe4f
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.14000fb14
mov esi, eax
test eax, eax
jns 0x14000fdc0
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400da264]
mov r9d, eax
mov edx, 0xcf
call fcn.14000f6a0
jmp 0x14000fe4f
lea r8, [0x1400da328]
lea rcx, [rsp + 0x30]
call fcn.14000df38
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000fdf8
mov edx, 0xd5
jmp 0x14000fd69
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000fb14
mov esi, eax
test eax, eax
jns 0x14000fe30
mov rcx, qword [rbp + 0x168]
lea r8, [0x1400da264]
mov r9d, eax
mov edx, 0xd7
call fcn.14000f6a0
mov rcx, rbx
call fcn.14000f760
jmp 0x14000fe4f
mov rcx, rbx
call fcn.14000f760
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x14000fe5c
mov rcx, rdi
call fcn.14000f760
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400c9030
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400409f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov r14, r9
mov rdi, r8
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
mov r10d, dword [rsp + 0x40]
mov r9d, 0
mov r11, rax
mov eax, 0x811c9dc5
add r10, r10
je 0x140040a58
movzx ecx, byte [r9 + r11]
inc r9
xor ecx, eax
imul eax, ecx, 0x1000193
cmp r9, r10
jb 0x140040a43
xor edx, edx
mov dword [r14], eax
div dword [rbx + 0x18]
mov rbx, qword [rbx + 8]
mov dword [rdi], edx
test rbx, rbx
je 0x140040ab7
mov rsi, qword [rsp + 0x60]
xor edi, edi
mov rbx, qword [rbx + rdx*8]
and qword [rsi], rdi
test rbx, rbx
je 0x140040ab7
mov eax, dword [r14]
cmp dword [rbx + 0x18], eax
jne 0x140040aa1
mov r8, qword [r15]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx]
call fcn.140040974
test eax, eax
js 0x140040ac2
cmp byte [rsp + 0x40], 0
jne 0x140040aaa
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
jmp 0x140040a79
mov rax, qword [rsp + 0x68]
mov qword [rsi], rdi
mov qword [rax], rbx
jmp 0x140040ac0
mov rax, qword [rsp + 0x68]
and qword [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140052ec4
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xc8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
nop dword [rax + rax]
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.140052c44
xor edi, edi
test eax, eax
js 0x140052f7f
mov rcx, qword [rbx + 0xf8]
call fcn.140055bb0
test eax, eax
js 0x140052f7f
mov qword [rbx + 0xd0], rdi
lea rdx, [rbx + 0xd0]
mov qword [rbx + 0xd8], rdi
mov qword [rbx + 0xe0], rdi
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rbx + 0xb8]
mov qword [rbx + 0xe8], rax
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_ConnectNamedPipe]
nop dword [rax + rax]
test eax, eax
jne 0x140052f5c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov dword [rbx + 0xf0], edi
cmp edi, 0x3e5
je 0x140052f7d
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140054c9c
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdx
mov rdi, rcx
mov esi, 1
lock add dword [rcx + 0x58], esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_StartThreadpoolIo]
nop dword [rax + rax]
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], sil
mov rax, qword [rbx + 8]
mov r9, qword [rax]
mov r8d, dword [r9 + 0x48]
mov rdx, qword [r9 + 0x40]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x90]
lea rax, [r9 + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x140054d43
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3e5
je 0x140054d43
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140054d61
mov ebx, 0x8000ffff
jmp 0x140054d61
xor ebx, ebx
test ebx, ebx
js 0x140054d61
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14005446e.0]
xor sil, sil
mov byte [rsp + 0x40], sil
test sil, sil
je 0x140054d7a
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CancelThreadpoolIo]
nop dword [rax + rax]
lock dec dword [rdi + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140054d94
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdx
mov rdi, rcx
mov esi, 1
lock add dword [rcx + 0x58], esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_StartThreadpoolIo]
nop dword [rax + rax]
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], sil
mov rax, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rax + 0xb0], xmm0
movups xmmword [rax + 0xc0], xmm0
mov rcx, qword [rbx]
mov rax, qword [rcx + 0xa8]
mov qword [rcx + 0xc8], rax
mov r9, qword [rbx]
mov r10, qword [r9 + 0xe8]
mov r8, qword [r9 + 0xf0]
sub r8, r10
mov rax, qword [r9 + 0x90]
mov rcx, qword [rax + 0x20]
mov edx, dword [r9 + 0x100]
lea rax, [r9 + 0xb0]
sub r8d, edx
add rdx, r10
mov qword [rsp + 0x20], rax
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x140054e79
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3e5
je 0x140054e79
cmp eax, 0xea
je 0x140054e79
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140054e97
mov ebx, 0x8000ffff
jmp 0x140054e97
xor ebx, ebx
test ebx, ebx
js 0x140054e97
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14005446e.0]
xor sil, sil
mov byte [rsp + 0x40], sil
test sil, sil
je 0x140054eb0
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CancelThreadpoolIo]
nop dword [rax + rax]
lock dec dword [rdi + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14009a65c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 0xb
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, r9
lea r8d, [rdx - 1]
call fcn.14008f3f4
mov rdx, qword [rbx + 8]
mov r8d, 0xf
sub rdx, qword [rbx]
mov rcx, qword [rsi]
sar rdx, 1
call fcn.140093ebc
mov rdi, qword [rbx]
mov rbx, qword [rbx + 8]
jmp 0x14009a72c
movzx ecx, word [rdi]
add rdi, 2
mov rax, qword [rsi]
movzx edx, cx
add cx, cx
sar dx, 0xf
xor dx, cx
mov r8, qword [rax]
mov ecx, dword [r8 + 0x20]
mov r9d, dword [r8 + 0x1c]
add rcx, 2
mov eax, dword [r8 + 0x18]
add rcx, r9
cmp rcx, rax
jae 0x14009a724
mov rcx, qword [r8 + 0x30]
movzx eax, dx
shr ax, 7
test ax, ax
je 0x14009a715
or dl, 0x80
mov byte [r9 + rcx], dl
movzx edx, ax
shr dx, 7
test dx, dx
je 0x14009a709
mov byte [r9 + rcx + 2], dl
or al, 0x80
mov edx, 3
jmp 0x14009a70e
mov edx, 2
mov byte [r9 + rcx + 1], al
jmp 0x14009a71e
mov byte [r9 + rcx], dl
mov edx, 1
add dword [r8 + 0x1c], edx
jmp 0x14009a72c
mov rcx, r8
call fcn.1400986dc
cmp rdi, rbx
jne 0x14009a6a6
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ba314
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov ebx, r9d
mov r14, r8
mov r15d, edx
mov rdi, rcx
mov r9d, edx
sub r9d, 0xe
je 0x1400ba478
sub r9d, 1
je 0x1400ba3ce
sub r9d, 1
je 0x1400ba3a6
cmp r9d, 1
je 0x1400ba37e
test ebx, ebx
je 0x1400ba525
mov edx, r15d
mov rcx, r14
call fcn.14008e008
add ebx, 0xffffffff
jne 0x1400ba369
jmp 0x1400ba525
mov qword [rbp - 0x10], r14
xor esi, esi
mov byte [rbp - 8], sil
test ebx, ebx
je 0x1400ba3a1
mov byte [rbp - 8], sil
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140095590
add ebx, 0xffffffff
jne 0x1400ba38c
jmp 0x1400ba525
mov qword [rbp - 0x10], r14
xor esi, esi
mov byte [rbp - 8], sil
test ebx, ebx
je 0x1400ba3c9
mov byte [rbp - 8], sil
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140095590
add ebx, 0xffffffff
jne 0x1400ba3b4
jmp 0x1400ba525
mov qword [rbp - 0x10], r14
xor esi, esi
mov byte [rbp - 8], sil
mov word [rbp + 0x38], si
mov r9, rbx
mov rbx, qword [rcx + 8]
mov r15, qword [rcx]
mov rax, rbx
sub rax, r15
sar rax, 1
cmp r9, rax
jae 0x1400ba414
lea rax, [r15 + r9*2]
cmp rax, r15
jne 0x1400ba406
mov qword [rcx + 8], r15
mov rbx, r15
jmp 0x1400ba435
cmp rax, rbx
je 0x1400ba435
mov rbx, rax
mov qword [rcx + 8], rax
jmp 0x1400ba435
jbe 0x1400ba435
sub r9, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x18]
call fcn.1400bd534
mov rbx, qword [rdi + 8]
mov r15, qword [rdi]
cmp r15, rbx
je 0x1400ba473
mov r12d, 1
mov rdi, r15
add r15, 2
mov byte [rbp - 8], sil
lea rdx, [rbp + 0x38]
mov rcx, r14
call fcn.14009d900
movzx eax, word [rbp + 0x38]
movzx ecx, ax
shr cx, 1
and ax, r12w
neg ax
xor cx, ax
mov word [rdi], cx
cmp r15, rbx
jne 0x1400ba440
jmp 0x1400ba525
mov qword [rbp - 0x10], r14
xor esi, esi
mov byte [rbp - 8], sil
mov word [rbp + 0x38], si
mov rdx, rbx
mov rax, qword [rcx + 8]
mov r9, qword [rcx]
mov rcx, rax
sub rcx, r9
sar rcx, 1
cmp rbx, rcx
jae 0x1400ba4be
lea rcx, [r9 + rbx*2]
cmp rcx, r9
jne 0x1400ba4b0
mov qword [rdi + 8], r9
mov rax, r9
jmp 0x1400ba4e5
cmp rcx, rax
je 0x1400ba4e5
mov rax, rcx
mov qword [rdi + 8], rcx
jmp 0x1400ba4e5
jbe 0x1400ba4e5
sub rdx, rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9, rdx
mov r8, rax
lea rdx, [rbp - 0x18]
mov rcx, rdi
call fcn.1400bd534
mov rax, qword [rdi + 8]
mov r9, qword [rdi]
cmp r9, rax
je 0x1400ba525
mov r12d, 1
mov r11, r9
add r9, 2
mov byte [rbp - 8], sil
mov ecx, dword [r14 + 0x18]
mov r10d, dword [r14 + 0x20]
sub ecx, r10d
cmp ecx, r12d
jb 0x1400ba53f
mov rdx, qword [r14 + 0x10]
movsx r8d, byte [r10 + rdx]
lea ecx, [r10 + 1]
mov dword [r14 + 0x20], ecx
mov word [r11], r8w
cmp r9, rax
jne 0x1400ba4f0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov edx, r12d
mov rcx, r14
call fcn.14006d590
int3
Function at 0x1400c8e30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14013a648], rbx
je 0x1400c8e7c
cmp rax, rbx
jne 0x1400c8e6f
mov ebx, 1
mov esi, ebx
jmp 0x1400c8e81
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400c8e54
mov ebx, 1
mov eax, dword [0x14013a650]
cmp eax, ebx
jne 0x1400c8e97
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400c8efc
mov eax, dword [0x14013a650]
test eax, eax
jne 0x1400c8ef6
mov dword [0x14013a650], ebx
lea r15, [0x1400d79b8]
lea rdi, [0x1400d79a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400c8ee8
test eax, eax
jne 0x1400c8eec
cmp qword [rdi], 0
je 0x1400c8edd
mov rax, qword [rdi]
mov rcx, qword [case.0x14005446e.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400c8ebe
test eax, eax
je 0x1400c8efc
mov eax, 0xff
jmp 0x1400c8fd8
mov dword [0x14012a740], ebx
mov eax, dword [0x14013a650]
cmp eax, ebx
jne 0x1400c8f23
lea rdx, [0x1400d7998]
lea rcx, [0x1400d6fc8]
call sub.msvcrt.dll__initterm
mov dword [0x14013a650], 2
test esi, esi
jne 0x1400c8f30
xor eax, eax
xchg qword [0x14013a648], rax
cmp qword [0x14013a668], 0
je 0x1400c8f64
lea rcx, [0x14013a668]
call fcn.1400c9460
test eax, eax
je 0x1400c8f64
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14013a668]
mov r9, qword [case.0x14005446e.0]
call r9
mov r8, qword [0x14012a758]
mov rdx, qword [0x14012a750]
mov ecx, dword [0x14012a748]
call fcn.14000bc3c
mov dword [0x14012a73c], eax
cmp dword [0x14012a760], 0
jne 0x1400c8f94
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14012a740], 0
jne 0x1400c8fa9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14012a73c]
jmp 0x1400c8fd8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401d4000
add rsp, 0x28
jmp 0x1400c8e30

Function at 0x1400c934c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c9398
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c9390
cmp dword [rcx + 0x3c], edx
jl 0x1400c9390
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400c9390
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400c9398
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180002f70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov r10, qword [0x180095490]
mov edi, edx
mov rsi, rcx
test r10, r10
jne 0x180003030
xorps xmm0, xmm0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x38]
xor r9d, r9d
add r11d, 0xfffffffe
je 0x180003083
mov rbx, qword [rsp + 0x30]
lea rbp, [0x1800830dc]
nop
mov r10d, r9d
lea rdx, [0x1800830e0]
add r10, rbx
mov cl, 0x78
mov r8, r10
mov rax, rbp
sub r8, rbp
cmp cl, 0x78
jne 0x180003016
movzx ecx, byte [r8 + rax]
cmp byte [rdx], cl
jne 0x180003077
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x180003008
mov qword [0x180095490], r10
test r10, r10
je 0x18000308e
xor eax, eax
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rsi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, edi
call fcn.18003ff80
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
inc r9d
cmp r9d, r11d
jb 0x180002ff0
mov qword [0x180095490], 0
xor r9d, r9d
lea r8, str.error
lea rdx, str.failed_to_find_valid_trampoline.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800030b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov r10, qword [0x180095498]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
test r10, r10
jne 0x18000316f
xorps xmm0, xmm0
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r11d, dword [rsp + 0x38]
xor r9d, r9d
add r11d, 0xfffffffe
je 0x1800031c5
mov rbx, qword [rsp + 0x30]
lea rdi, [0x1800830dc]
nop word [rax + rax]
mov r10d, r9d
lea rdx, [0x1800830e0]
add r10, rbx
mov al, 0x78
mov r8, r10
mov rcx, rdi
sub r8, rdi
cmp al, 0x78
jne 0x180003155
movzx eax, byte [r8 + rcx]
cmp byte [rdx], al
jne 0x1800031b9
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x180003148
mov qword [0x180095498], r10
test r10, r10
je 0x1800031d0
lea rax, [fcn.18004fa58]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x58], rax
movaps xmm0, xmm6
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.18003ff80
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret
inc r9d
cmp r9d, r11d
jb 0x180003130
mov qword [0x180095498], 0
xor r9d, r9d
lea r8, str.error
lea rdx, str.failed_to_find_valid_trampoline.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1800043a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1800990e4], 0
lea rdi, [0x1800990e0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x180004478
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1800043d0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1800044ae
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x180004490
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1800044ef
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1800044d3
cmp byte [r8], r9b
jne 0x1800044d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1800044c0
not eax
pop rdi
ret

Function at 0x180004e90
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
movsxd rbp, r9d
mov rsi, r8
test r8, r8
je 0x180004eaa
mov dword [r8], 0
call fcn.180004cb0
mov rbx, rax
test rax, rax
jne 0x180004ebf
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x48], r14
lea r8d, [rdx + 2]
call fcn.180051258
test eax, eax
jne 0x180004fa9
mov rcx, rbx
call fcn.18005049c
movsxd r14, eax
cmp r14d, 0xffffffff
je 0x180004fa9
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.180051258
test eax, eax
jne 0x180004fa9
mov rcx, qword [0x180092fd0]
lea eax, [r14 + rbp]
inc dword [rcx + 0x354]
mov rdx, qword [rcx + 0xf0]
movsxd rcx, eax
call rdx
mov rdi, rax
test rax, rax
je 0x180004fa9
mov r9, rbx
mov qword [rsp + 0x50], r15
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.180054958
cmp rax, r14
je 0x180004f82
mov rcx, rbx
call fcn.180050f50
mov rax, qword [0x180092fd0]
mov rcx, rdi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
test ebp, ebp
jle 0x180004f94
mov r8, rbp
lea rcx, [r14 + rdi]
xor edx, edx
call fcn.18004b9a0
mov rcx, rbx
call fcn.180050f50
test rsi, rsi
je 0x180004fa4
mov dword [rsi], r14d
mov rax, rdi
jmp 0x180004f6b
mov rcx, rbx
call fcn.180050f50
xor eax, eax
jmp 0x180004f70