joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015728
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x40
mov r14d, edx
mov rbx, rcx
add rcx, 0x38
cmp dword [rcx + 0x28], 0
je 0x140015757
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor dil, dil
mov byte [rsp + 0x30], dil
cmp qword [rbx + 8], 0
jne 0x1400157b5
mov rcx, qword [rbx]
xor edx, edx
mov rsi, r14
test rcx, rcx
je 0x14001578f
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [rbx + 8], rax
test rdx, rdx
je 0x1400157b5
shr rsi, 1
mov al, byte [rsi + rdx]
mov byte [rsi + rdx], al
lea eax, [r14 - 1]
mov ecx, eax
mov al, byte [rax + rdx]
mov byte [rcx + rdx], al
mov dword [rbx + 0x14], r14d
mov dil, 1
mov byte [rsp + 0x30], dil
jmp 0x1400157c5
lea rcx, [rbx + 0x38]
cmp dword [rcx + 0x28], 0
je 0x1400157d5
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, dil
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140016298
Capabilities:
Read .ini file

Disassembly:
mov r11d, r9d
mov r10, r8
lea r9, [rcx + 8]
mov rax, rdx
cmp qword [r9 + 0x18], 8
jb 0x1400162af
mov r9, qword [r9]
cmp qword [r8 + 0x18], 8
jb 0x1400162b9
mov r10, qword [r8]
cmp qword [rdx + 0x18], 8
jb case.default.0x1400162cc
mov rax, qword [rdx]
mov r8d, r11d
mov rdx, r10
mov rcx, rax
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
fistp qword [rax]
and dword [rax + 1], edx
push 0xffffffffffffffca
adc al, byte [rbp + rsi*2 + 0x2501e61b]
cmp al, 0xd0
invalid
jne 0x1400979f6
xchg edx, eax
cmp al, 0xcc
mov esi, 0x468a01a1
add dword [rdx + 0x6b915f46], ecx
invalid
mov bh, bh
invalid
invalid
invalid
out dx, eax
xor byte [rbp + 0x77], dh
sub dword [rsi], esi
adc eax, 0xa4f140c1
int1
movsb byte [rdi], byte [rsi]
xchg byte [rax - 0x4047c51], cl
mov dword [rdx - 0x188ff2d8], edi
outsb dx, byte [rsi]
iretd
ficomp dword [0x133a8f666]
invalid
jo 0x140097c4c
cmpsd dword [rsi], dword [rdi]
sbb byte [rcx + 0x111f7ce7], 0xfe
adc esi, edi
sub al, bl
scasd eax, dword [rdi]
cmp eax, 0x20547047
push rsp
invalid
invalid
push rsp
and byte [rdi + rdx - 0x43], cl
add byte [rsp + rdi], al
add byte [rbp + 0x39], dl
invalid
inc dword [rdi - 0x178e8092]
mov ecx, 0x5ae2ffbc
pop rdx
invalid
sbb eax, 0x2946be54
push rdi
wait
leave
cmp edi, dword [rbx - 0x165a2b66]
mov dl, 0x73
jae 0x140097c21
invalid
Function at 0x1400162d4
Capabilities:
Read .ini file

Disassembly:
push rbx
add rcx, 8
mov r10, r9
mov r11, r8
mov rbx, rdx
cmp qword [rcx + 0x18], 8
jb case.default.0x140016309
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x38]
mov r8, r10
mov r9, qword [rsp + 0x30]
mov rdx, r11
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov dword [rsp + 0x30], eax
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add dword [rdx + 0x6b915f46], ecx
cmp dword [rdx + 0x363b62ff], ecx
sub al, 0xa9
retf
int1
movsb byte [rdi], byte [rsi]
sbb bh, byte [rbx]
mov r11b, 0x2a
retf
inc dword [rdi - 0x178e8092]
push rdx
pop rdi
call qword [rbp + rbx + 0x2946be54]
sbb eax, 0x2946be54
jae 0x140097c21
mov ah, byte [rsi - 0x67]
jno 0x140097c84
stc
mov bl, 0xff
adc eax, 0xa266d6c2
push rcx
xor bh, dh
inc bl
inc bl
push rdx
push 0x6c
xchg edi, eax
xor ebx, dword [rbp - 0x919712f]
outsd dx, dword [rsi]
movabs byte [0x93bd71d759c8905], al
xchg esp, eax
push rsi
jo 0x140097cab
movsb byte [rdi], byte [rsi]
sbb r10, qword [rcx - 0x2fe2fcb0]
scasb al, byte [rdi]
push rdi
jb 0x140097c22
push rax
add ebx, dword [0x1b2612b58]
cdq
shr byte [rsi - 0x2668da9], 1
std
xor byte [rdx], bl
sbb edx, ecx
sub ecx, esi
rol byte [rax], 1
fsubp st(3)
stc
push qword [rsi - 0x73]
jg 0x140097c81
and ah, byte [rcx + 0x29746da9]
invalid
xor dword [rdx + 0x37], edi
cwde
shl dword [rax], 0x4e
pop rsp
xlatb
sub ebp, edx
in eax, 0xc1
fisttp word [rcx]
movabs al, byte [0x1d6868d1ce330fa]
movabs eax, dword [0xa1ff14f6a7453828]
cli
inc qword [r8 + r15*2]
sbb dh, bh
pop rsp
jne 0x140097d01
jmp [0xe70b07e2]
scasd eax, dword [rdi]
and ch, ah
sbb esi, dword [rbp + 0xb81ec8f]
test eax, 0xf962732d
out dx, eax
pop rbx
sahf
add al, 0xd1
mov eax, 0x94310c44
mov edx, 0x2a00db42
add byte [rdx], ch
jp 0x140097d4f
lahf
invalid
js 0x140097d1e
call 0xfde9aceb
adc al, 0xa1
pop rdi
xor al, 0xa5
jmp 0xfa1448d5
Function at 0x1400167b8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rcx], 0
mov rbx, rcx
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
lea rcx, str.crypt32.dll
call fcn.14000d53c
mov rdi, rax
test rax, rax
je 0x1400168b7
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertFindCertificateInStore
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertFreeCertificateContext
mov rcx, rdi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertGetNameStringW
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDecodeObject
mov rcx, rdi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgClose
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgGetParam
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptQueryObject
mov rcx, rdi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgClose
mov rcx, rdi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001aad8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov dil, r9b
mov rax, rdx
mov r9, qword [rcx + 0x18]
mov rbx, rcx
test r9, r9
je 0x14001ab12
movsxd r8, r8d
mov edx, 1
mov rcx, rax
call fcn.1400274a8
test dil, dil
je 0x14001ab12
mov rcx, qword [rbx + 0x18]
call fcn.1400281fc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001aba4
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdx, [rsp + 0x20]
mov rdi, rcx
call fcn.14001ab78
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x14001ac18
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001ac18
mov edx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001abfc
mov eax, dword [rbx + 0x10]
mov edi, 1
mov dword [0x14005b1b0], eax
mov edx, edi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14001ac1d
mov rcx, rdi
call fcn.14001ac74
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, dword [rsp + 0x48]
jmp 0x14001ac1d
mov edi, 1
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14001ac67
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001ac67
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax]
call qword [0x1400405a8]
or ecx, 0xffffffff
lock xadd dword [rbx + 0xc], ecx
cmp ecx, 1
jne 0x14001ac67
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [0x1400405a8]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x14001ada4
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x14001ae80]
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x10]
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], 4
call fcn.140028a9c
mov rcx, rax
test rax, rax
je 0x14001ae5f
mov rax, qword [rdi]
mov rdx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rdi]
add rcx, 0x18
call fcn.14000bbb0
mov rax, qword [rdi]
xor ecx, ecx
mov ebp, dword [rax + 0x10]
lea rax, [0x14005b0e0]
cmp dword [rax], 0
je 0x14001ae2c
inc ecx
lea rdx, [0x14005b1f0]
add rax, 0x44
cmp rax, rdx
jl 0x14001ae13
jmp 0x14001ae50
movsxd rax, ecx
lea r14, [0x14005b0a0]
imul rbx, rax, 0x44
mov r8, rsi
mov edx, 0x40
lea rcx, [rbx + r14]
call fcn.1400276e8
mov dword [rbx + r14 + 0x40], ebp
mov rcx, qword [rdi]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140002000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002028
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000204e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002050
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400020a9
test ecx, ecx
jle 0x140002089
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400020a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400020a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400020d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400020f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002108
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002124
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002126
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002162
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400021fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000219d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400021de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400021fe
cmp rbx, rax
ja 0x1400021b0
test rbx, rbx
je 0x1400021fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000268d
xor eax, eax
jmp 0x1400027f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400026c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400026c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400027f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400027ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000270a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002735
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400027f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400027a4
sub eax, 1
je 0x1400027a4
cmp eax, 2
jne 0x1400027ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400027f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400027d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400027ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400027f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400b6940
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002b70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002c43
cmp byte [rcx + 0x71], 0
je 0x140002c43
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140002c3f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c04
sub eax, 1
je 0x140002c08
cmp eax, 2
jne 0x140002c3f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6940
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002c36
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c3f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002bec
xor al, al
jmp 0x140002bec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6940
add rsp, 0x60
pop rbx
ret
Function at 0x140003260
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x80
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov eax, r8d
mov dword [rsp + 0x61], ebp
mov word [rsp + 0x65], bp
mov byte [rsp + 0x67], bpl
mov dword [rsp + 0x40], 0x69b5b39
mov qword [r11 - 0x30], rax
mov eax, dword [0x140100034]
mov qword [r11 - 0x40], rcx
mov qword [r11 - 0x38], rdx
mov dword [rsp + 0x44], eax
mov rax, qword [0x1401020a0]
mov byte [rsp + 0x60], bpl
test rax, rax
jne 0x14000337b
mov rax, qword gs:[0x60]
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140003354
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140003354
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000334f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003330
cmp edx, 0xb04cce94
je 0x1400033bd
test r8d, r8d
jne 0x140003310
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x1400032e0
mov rax, rbp
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xa8]
mov qword [0x1401020a0], rax
mov rcx, qword [0x140100048]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov r9d, Ordinal_45
mov qword [rsp + 0x30], rbp
mov edx, 0x226400
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b6940
add rsp, 0x80
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140003362
Function at 0x1400033e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x60
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140100034]
xor ebp, ebp
mov dword [rsp + 0x40], eax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x44], ebp
mov qword [r11 - 0x20], rax
mov rax, qword [0x1401020a0]
mov qword [r11 - 0x18], rbp
test rax, rax
jne 0x1400034eb
mov rax, qword gs:[0x60]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400034c4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400034c4
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400034bf
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400034a0
cmp edx, 0xb04cce94
je 0x14000352f
test r8d, r8d
jne 0x140003480
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x140003450
mov rax, rbp
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov qword [0x1401020a0], rax
mov rcx, qword [0x140100048]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rbp
mov edx, 0x226664
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b6940
add rsp, 0x60
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400034d2
Function at 0x140003550
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x70
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [0x1401020a0]
xor ebp, ebp
mov word [rsp + 0x4a], bp
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], edx
mov word [r11 - 0x30], r8w
test rax, rax
jne 0x14000364b
mov rax, qword gs:[0x60]
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x10]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140003624
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140003624
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000361f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003600
cmp edx, 0xb04cce94
je 0x14000368a
test r8d, r8d
jne 0x1400035e0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x1400035b0
mov rax, rbp
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x98]
mov qword [0x1401020a0], rax
mov rcx, qword [0x140100048]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov r9d, listen
mov qword [rsp + 0x30], rbp
mov edx, 0x2265e4
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b6940
add rsp, 0x70
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140003632
Function at 0x14000f600
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400cac3c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cac40]
call fcn.1400031d0
lea rcx, [0x1400cac48]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.______________________Insira_Sua_Key:______________________n
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cacc8]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp qword [rbx + 0x10], 0
lea rcx, [0x1400ca998]
je 0x14000f742
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cad08]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cad0c]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000f72e
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str._Status:__s_n
add rsp, 0x20
pop rbx
jmp fcn.1400031d0
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cad08]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400cad0c]
call fcn.1400031d0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._Inserir_Key:
add rsp, 0x20
pop rbx
jmp fcn.1400031d0