joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402a5932
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90

Function at 0x1402a59ba
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140088030
call fcn.140089e70
call fcn.14008a9d0
call fcn.140091dd4
call fcn.1400c31b0
call fcn.1400def32
call fcn.140115dc9
call fcn.14015bc74
call fcn.14016e80f
call fcn.1401876e0
call fcn.140188eb0
call fcn.1401ce210
nop
add rsp, 0x28
jmp 0x1401edba0
sub rsp, 0x28
call fcn.14000770d
call fcn.140007ae2
call fcn.14000a633
call fcn.14004e410
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1402c6150]
mov dword [rax], ecx
mov rdx, qword [0x1402c6160]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call int.14004e2e0
call fcn.1400d92e0
call fcn.1400d94a0
call fcn.140187850
call fcn.14029fef1
call fcn.1402a1b52
nop
add rsp, 0x28
jmp 0x1402a5970

Function at 0x1402a7732
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140336e68]
test eax, eax
je 0x1402a77ca
lea rax, [0x140336e40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140336e70]
mov qword [rbp - 8], rax
jmp 0x1402a77ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1402a77a2
cmp qword [rbp - 0x10], 0
je 0x1402a77a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1402a7768
lea rax, [0x140336e40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1402a77cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1402a78d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1402a78f8
mov eax, 0
jmp 0x1402a7946
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1402a7921
mov eax, 0
jmp 0x1402a7946
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1402a7941
mov eax, 0
jmp 0x1402a7946
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1402a794c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1402a79ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1402a79c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1402a79c1
mov rax, qword [rbp - 8]
jmp 0x1402a79df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1402a7994
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword gs:[0x60]
xor edi, edi
mov r14d, ecx
mov ebp, edi
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
mov dword [rsp + 0x20], 0x74006e
mov dword [rsp + 0x24], 0x6c0064
mov dword [rsp + 0x28], 0x2e006c
mov dword [rsp + 0x2c], 0x6c0064
mov dword [rsp + 0x30], 0x6c
cmp rbx, rsi
je 0x1400012ee
nop dword [rax]
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x50]
call fcn.140009df4
test eax, eax
je 0x140001376
cmp rbx, rsi
jne 0x1400012d0
movsxd rax, dword [rbp + 0x3c]
mov r11d, edi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r15
mov ecx, dword [rax + rbp + 0x88]
add rcx, rbp
mov r15d, dword [rcx + 0x24]
mov r12d, dword [rcx + 0x1c]
add r15, rbp
mov ebx, dword [rcx + 0x20]
add r12, rbp
mov esi, dword [rcx + 0x14]
add rbx, rbp
test esi, esi
je 0x1400013ea
nop
mov r10d, dword [rbx]
mov rdx, rdi
add r10, rbp
lea rax, [r10 + 2]
nop dword [rax]
cmp byte [rax - 2], dil
je 0x1400013a1
cmp byte [rax - 1], dil
je 0x14000139e
cmp byte [rax], dil
je 0x140001398
cmp byte [rax + 1], dil
je 0x140001392
cmp byte [rax + 2], dil
je 0x14000138c
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x140001340
mov r8d, 0x498157
mov r9d, edi
jmp 0x1400013b0
mov rbp, qword [rbx + 0x20]
cmp r14d, 5
jne 0x1400012ee
mov rax, rbp
jmp 0x140001466
add rdx, 4
jmp 0x1400013a1
add rdx, 3
jmp 0x1400013a1
add rdx, 2
jmp 0x1400013a1
inc rdx
mov r8d, 0x498157
mov r9d, edi
test rdx, rdx
je 0x1400013d5
nop
movsx eax, byte [r10]
lea r10, [r10 + 1]
imul ecx, r8d, 0x25aecf
inc r9d
add ecx, eax
movsxd rax, r9d
and ecx, 0xbcedfa
add r8d, ecx
cmp rax, rdx
jb 0x1400013b0
cmp r8d, r14d
je 0x1400013fa
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x140001330
mov rdx, qword [0x14002a3b8]
test rdx, rdx
jne 0x14000141e
xor eax, eax
jmp 0x140001456
mov eax, r11d
movzx ecx, word [r15 + rax*2]
mov edx, dword [r12 + rcx*4]
add rdx, rbp
mov qword [0x14002a3b8], rdx
cmp r14d, 0x6af74b3
jne 0x1400013f1
mov rax, rdx
jmp 0x140001456
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
nop
movsxd rcx, edi
lea rax, [rcx + 1]
cmp byte [rsp + rax + 0x38], 5
jne 0x140001445
cmp byte [rsp + rcx + 0x3a], 0xc3
je 0x14000144f
inc edi
cmp rax, 0x20
jb 0x140001430
jmp 0x140001456
movzx eax, dil
add rax, rdx
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002530
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140001490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov ecx, 5
call fcn.140001260
mov r14, rax
xor ebp, ebp
movsxd rdx, dword [rax + 0x3c]
mov r8d, dword [rdx + rax + 0x88]
mov r12d, dword [rdx + rax + 0xa0]
add r8, rax
add r12, rax
mov eax, dword [r8 + 0x1c]
mov ecx, dword [r8 + 0x24]
add rax, r14
mov qword [rsp + 0x78], rax
add rcx, r14
mov eax, dword [r8 + 0x20]
add rax, r14
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rax
cmp dword [r12], ebp
je 0x140001658
mov r15d, dword [r8 + 0x14]
mov r9d, 0x775a
nop dword [rax + rax]
xor ebx, ebx
test r15d, r15d
je 0x140001649
mov r13d, dword [r12]
mov rdi, rcx
mov rsi, rax
nop word [rax + rax]
mov r11d, dword [rsi]
add r11, r14
xor edx, edx
lea rax, [r11 + 2]
nop dword [rax]
cmp byte [rax - 2], 0
je 0x14000158b
cmp byte [rax - 1], 0
je 0x140001588
cmp byte [rax], 0
je 0x140001582
cmp byte [rax + 1], 0
je 0x14000157c
cmp byte [rax + 2], 0
je 0x140001576
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x140001540
mov r10d, 0x498157
xor r8d, r8d
jmp 0x140001599
add rdx, 4
jmp 0x14000158b
add rdx, 3
jmp 0x14000158b
add rdx, 2
jmp 0x14000158b
inc rdx
xor r8d, r8d
mov r10d, 0x498157
test rdx, rdx
je 0x1400015cb
mov r9, r11
nop dword [rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
imul ecx, r10d, 0x25aecf
inc r8d
add ecx, eax
movsxd rax, r8d
and ecx, 0xbcedfa
add r10d, ecx
cmp rax, rdx
jb 0x1400015a0
mov r9d, 0x775a
movzx eax, word [rdi]
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx + rax*4]
cmp r8d, r13d
jne 0x140001626
movzx eax, byte [r11]
mov rdx, r11
mov rcx, r11
test al, al
je 0x140001602
nop word [rax + rax]
cmp al, byte [rcx]
jne 0x140001602
movzx eax, byte [rdx + 1]
inc rdx
inc rcx
test al, al
jne 0x1400015f0
cmp r10d, dword [rsp + 0x70]
jne 0x14000161e
movzx ecx, byte [rcx]
lea rax, [r14 + r8]
mov qword [0x14002a3b8], rax
movzx eax, byte [rdx]
cmp eax, ecx
je 0x140001658
cmp word [r11], r9w
jne 0x140001626
inc ebp
inc ebx
add rsi, 4
add rdi, 2
cmp ebx, r15d
jb 0x140001530
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
add r12, 0xc
cmp dword [r12], 0
jne 0x140001510
movzx eax, bpl
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000325c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400032a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400032a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400032a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400032a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400032a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400032a8
xor al, al
add rsp, 0x28
ret

Function at 0x14000793c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400077cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400077cf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400077cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400077cf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400077cf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400077cf
cmp dword [rcx + 0xf8], 0
je 0x1400077cf
mov ecx, ebx
call fcn.140007870
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140007660
cmp dword [rbp + 0x20], 0
je 0x14000781c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007824
int3
xor r8d, r8d
xor edx, edx
jmp 0x140007768

Function at 0x140019530
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140019558
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140019558
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1402324f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1402324fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14023250d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1402324f5
lea eax, [rcx + 1]
jmp 0x14023251b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14023252e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140232514
sub eax, 3
jb 0x14023254e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14023259d
sar eax, 1
movsxd rbp, eax
jb 0x140232584
jmp 0x14023255c
add ebx, ebx
jne 0x14023255a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140232584
inc ecx
add ebx, ebx
jne 0x14023256a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140232584
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14023257d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14023256c
add ecx, 2
jmp 0x140232589
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1402324b2
jmp 0x1402324fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x175a00
mov dl, 0x2a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1402325ed
cmp rsi, rcx
jae 0x1402325f5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1402325d4
cmp al, 0x8f
ja 0x1402325d4
cmp byte [rsi - 2], 0xf
je 0x1402325da
sub al, 0xe8
cmp al, 1
ja 0x1402325be
cmp rsi, rcx
jae 0x1402325f5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1402325c4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1402325f5
lodsb al, byte [rsi]
jmp 0x1402325d4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x22e000]
mov eax, dword [rdi]
or eax, eax
je 0x14023265e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x24d67c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140232602
jns 0x140232637
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140232641
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140232658
mov qword [rbx], rax
add rbx, 8
jmp 0x140232622
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1402326a2
cmp al, 0xef
ja 0x14023268a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14023266a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140232679
mov eax, dword [rdi]
add rdi, 4
jmp 0x140232679
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1402326f6
sub rsp, 0xffffffffffffff80
jmp 0x140118e5c
Function at 0x1401321d3
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
pop r13
movabs r13, 0x17b653000001d4e9
jb 0x14013252d
lea r15d, [rcx + 0xd932]
rcr r13d, 0x6c
jmp rax
jp 0x140132cb4
lea edi, [rbp - 0x90f9]
sub r12d, 0x5b49004b
movabs r12, 0x1f842bffffff10e9
div r9
bswap r15
rcl ebp, 0xa7
lea r14d, [rbx - 0xb480]
mov ebx, dword [rbx]
Function at 0x180001530
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001558
xor eax, eax
lea r8, [0x1800011c0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x38
ret
Function at 0x140001520
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor eax, eax
lea rsi, [0x140025020]
nop dword [rax + rax]
xor byte [rax + rsi], 0x82
xor byte [rax + rsi + 1], 0x82
add rax, 2
cmp rax, 0x18f266
jl 0x140001540
mov ebx, dword [0x140025020]
lea rcx, [0x14001f6b0]
mov dword [rsp + 0x30], 0x74726956
mov dword [rsp + 0x34], 0x416c6175
mov dword [rsp + 0x38], 0x636f6c6c
mov byte [rsp + 0x3c], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
mov edi, ebx
call rax
mov rbx, rax
test rax, rax
je 0x1400015eb
lea rdx, [0x140025024]
mov r8d, edi
mov rcx, rax
call fcn.140004ed0
mov r9, rsi
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140001600
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x80
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
cpuid
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x2c], edx
mov eax, 1
cpuid
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x24], ebx
xor ecx, ecx
lea r9d, [rdx + rax]
mov eax, 3
cpuid
mov dword [rsp + 0x20], eax
xor eax, eax
mov dword [rsp + 0x24], ebx
lea r8d, [rcx + rdx]
lea rdx, str._08X
lea rcx, [rsp + 0x20]
add r8d, r9d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
call fcn.140002390
lea rdx, str.178F02CO
lea rcx, [rsp + 0x20]
call fcn.140009bd0
lea rcx, [0x14001f6e8]
test eax, eax
je 0x14000169e
lea rcx, [0x14001f6f4]
call fcn.1400056a4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor al, al
add rsp, 0x80
pop rbx
ret
Function at 0x1400017c0
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov edi, r9d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140001903
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x14000192a
call fcn.140001600
test al, al
jne 0x140001951
call fcn.1400016d0
test al, al
jne 0x140001978
call fcn.140001520
xor edx, edx
lea r9, [rsp + 0x20]
lea r8d, [rdx + 0x40]
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9d, 0x64
lea r8, [0x1401b5ac0]
lea edx, [r9 + 3]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x64
lea r8, [0x1401b5b90]
lea edx, [r9 + 9]
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, rbx
call fcn.1400019a0
mov edx, edi
mov rcx, rbx
call fcn.140001a30
test eax, eax
jne 0x140001880
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov edx, 0x6d
mov rcx, rbx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400018f4
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400018dd
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400018b0
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rdx, [0x14001f758]
call fcn.1400023c0
mov rcx, rax
mov rbx, rax
call fcn.140001c10
mov rcx, rbx
call fcn.140001d50
xor ecx, ecx
call fcn.140005bb0
int3
lea rdx, [0x14001f768]
call fcn.1400023c0
mov rcx, rax
mov rbx, rax
call fcn.140001c10
mov rcx, rbx
call fcn.140001d50
xor ecx, ecx
call fcn.140005bb0
int3
lea rdx, [0x14001f780]
call fcn.1400023c0
mov rcx, rax
mov rbx, rax
call fcn.140001c10
mov rcx, rbx
call fcn.140001d50
xor ecx, ecx
call fcn.140005bb0
int3
lea rdx, [0x14001f790]
call fcn.1400023c0
mov rcx, rax
mov rbx, rax
call fcn.140001c10
mov rcx, rbx
call fcn.140001d50
xor ecx, ecx
call fcn.140005bb0
int3

Function at 0x140005bb0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140005a18
Function at 0x180004dc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180004e1d
lea rbx, [0x180057770]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180004e04
cmp r10, 2
jb 0x180004e04
cmp byte [r9], r8b
jne 0x180004e04
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180004de0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180004e5f
lea rbx, [0x180057770]
cmp r8b, 0x23
jne 0x180004e43
cmp byte [r9], r8b
jne 0x180004e43
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180004e30
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800050d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1800050ff
mov r8d, 0x599
lea rdx, str.C:UserscerisOneDriveDesktop1v1.lol_cheat__2_1v1.lol_cheat1v1.lol_cheatImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x18000510b
mov qword [rdi], 0
lea rdx, [0x180057438]
mov rcx, rbx
call fcn.180004e70
mov rbx, rax
test rax, rax
jne 0x18000512d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180005204
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005204
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x180005204
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005204
cmp rsi, 0xffffffffffffffff
je 0x180005204
mov rax, qword [0x1800af6b8]
test rax, rax
je 0x1800051a1
inc dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x180005204
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1800051f1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800af6b8]
test rax, rax
je 0x1800051e6
dec dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000520d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800051ff
mov qword [rdi], rsi
mov rax, rbp
jmp 0x18000520f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180007060
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x180007096
mov r8d, 0x505
lea rdx, str.C:UserscerisOneDriveDesktop1v1.lol_cheat__2_1v1.lol_cheat1v1.lol_cheatImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x180057770]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1800af6b8]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a60], edx
jne 0x180007110
mov dword [rax + 0x1a64], edx
cmp dword [rax + 0x1a9c], edx
jne 0x18000711f
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret