joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010bbe0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rax, qword [0x1401450c0]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x1e0]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_26
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov qword [rsp + 0x50], rax
lea rdx, str.Cheat_Engine_7.5
lea rcx, [rsp + 0xb0]
call fcn.14008c1b0
nop
lea rdx, [0x140124764]
lea rcx, [rsp + 0xd0]
call fcn.14008c1b0
nop
lea rdx, [0x140124770]
lea rcx, [rsp + 0xf0]
call fcn.14008c1b0
nop
lea rdx, str.x64dbg
lea rcx, [rsp + 0x110]
call fcn.14008c1b0
nop
lea rdx, str.FileGrab
lea rcx, [rsp + 0x130]
call fcn.14008c1b0
nop
lea rdx, str.Nigger
lea rcx, [rsp + 0x150]
call fcn.14008c1b0
nop
lea rdx, str.Beammer
lea rcx, [rsp + 0x170]
call fcn.14008c1b0
nop
lea rdx, str.Process_Hacker
lea rcx, [rsp + 0x190]
call fcn.14008c1b0
nop
lea rdx, str.dexzunpacker
lea rcx, [rsp + 0x1b0]
call fcn.14008c1b0
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x78]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa0]
lea rcx, [rsp + 0x90]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1e0]
call fcn.1400f4d20
nop
lea r9, [fcn.140085c10]
mov r8d, 9
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rsp + 0xb0]
call fcn.140110580
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
jmp 0x14010bd9d
mov rax, qword [rsp + 0x28]
add rax, 0x20
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x28], rax
je 0x14010be61
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 7
jbe 0x14010bde1
mov dword [rsp + 0x24], 1
jmp 0x14010bde9
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14010be12
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140103290
movzx eax, al
test eax, eax
je 0x14010be5c
mov rcx, qword [rsp + 0x48]
call fcn.14008c1a0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x88], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x14010bd8f
lea rcx, [rsp + 0x1e0]
call fcn.14010bff0
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.140110cc0
add rsp, 0x208
pop rdi
pop rsi
ret
Function at 0x14010d810
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x6c8
mov rax, qword [0x1401450c0]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x14010d84e
xor eax, eax
jmp 0x14010d932
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14010d87b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14010d932
mov edx, dword [rsp + 0x38]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14010d90e
mov dword [rsp + 0x270], 0x438
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x14010d903
mov rdx, qword [rsp + 0x6d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x14010d8ed
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14010d932
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x14010d8b7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14010d87b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140110cc0
add rsp, 0x6c8
ret
Function at 0x14010d950
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x6c8
mov rax, qword [0x1401450c0]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
movzx eax, byte [0x140a56422]
test eax, eax
je 0x14010da7f
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x14010d99d
xor al, al
jmp 0x14010da7f
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14010d9ca
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14010da7f
mov edx, dword [rsp + 0x38]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14010da5b
mov dword [rsp + 0x270], 0x438
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x14010da50
mov rdx, qword [rsp + 0x6d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x14010da3a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14010da7f
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x14010da06
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14010d9ca
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140110cc0
add rsp, 0x6c8
ret
Function at 0x14010dc30
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14010dc85
lea rdx, str.Failed_to_open_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14008cba0
mov qword [rsp + 0x28], rax
lea rdx, [0x1400f4a60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14010dcdc
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14010dccf
lea rdx, str.Failed_to_terminate_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14008cba0
mov qword [rsp + 0x30], rax
lea rdx, [0x1400f4a60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14010dcdc
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x48
ret

Function at 0x14010dfd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, Ordinal_50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14010e017
xor al, al
jmp 0x14010e0b9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14010e041
xor al, al
jmp 0x14010e0b9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x14010e0b1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x14010e0b1
mov al, 1
jmp 0x14010e0b9
jmp 0x14010e0b7
xor al, al
add rsp, 0x78
ret
Function at 0x14010e3c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140a56b38]
mov qword [rsp + 0x28], rax
jmp 0x14010e3e0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14010e40f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14010e40d
call sub.KERNEL32.dll_GetLastError
jmp 0x14010e411
jmp 0x14010e3d2
xor eax, eax
add rsp, 0x38
ret
Function at 0x14010e450
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x140a56b50], eax
je 0x14010e47d
mov eax, 0x10dd
jmp 0x14010e696
cmp dword [0x140a56b54], 0
je 0x14010e491
mov eax, dword [0x140a56b54]
jmp 0x14010e696
cmp qword [rsp + 0x78], 0
jne 0x14010e4a3
mov eax, 0x57
jmp 0x14010e696
cmp qword [rsp + 0x70], 0
jne 0x14010e4b5
mov eax, 6
jmp 0x14010e696
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x14010e4e7
mov dword [rsp + 0x20], 6
mov eax, dword [rsp + 0x20]
mov dword [0x140a56b54], eax
mov rax, qword [rsp + 0x70]
mov qword [0x140a56b58], rax
mov eax, dword [rsp + 0x20]
jmp 0x14010e696
mov ecx, Ordinal_50
call fcn.140110544
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14010e559
mov dword [rsp + 0x20], 8
mov eax, dword [rsp + 0x20]
mov dword [0x140a56b54], eax
cmp qword [rsp + 0x30], 0
je 0x14010e544
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x50]
call fcn.140110898
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov qword [0x140a56b58], rax
mov eax, dword [rsp + 0x20]
jmp 0x14010e696
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.14010e420
mov qword [rsp + 0x38], rax
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.14010e420
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x3e]
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x48]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
je 0x14010e5b6
movsxd rax, dword [rsp + 0x24]
cmp rax, 0x1e
jbe 0x14010e5d3
mov dword [rsp + 0x20], 9
cmp dword [0x140a56b48], 0
je 0x14010e5ce
jmp 0x14010e51a
jmp 0x14010e510
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 0x50], rcx
je 0x14010e600
mov dword [rsp + 0x20], 9
cmp dword [0x140a56b48], 0
je 0x14010e5fb
jmp 0x14010e51a
jmp 0x14010e510
mov dword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x14010e637
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x14010e510
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x28]
mov dword [rax + 0x28], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x140a56b68]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [0x140a56b68], rax
xor eax, eax
add rsp, 0x68
ret
Function at 0x14010e6a0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x140a56b50], eax
je 0x14010e6bb
mov eax, 0x10dd
jmp 0x14010e7e0
mov rax, qword [0x140a56b68]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14010e765
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x14010e730
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x14010e730
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.14010ddd0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, Ordinal_50
mov rcx, qword [rsp + 0x38]
call fcn.140110898
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x14010e6c7
mov qword [0x140a56b68], 0
call fcn.14010e180
mov rax, qword [0x140a56b60]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14010e7c9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.140110898
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x14010e781
mov qword [0x140a56b60], 0
mov dword [0x140a56b50], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x14010ed10
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x140a56b54], 0
je 0x14010ed2d
mov eax, dword [0x140a56b54]
jmp 0x14010edf3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x14010ed40
xor eax, eax
jmp 0x14010edf3
mov ecx, reloc.WS2_32.dll_recv
call fcn.140110544
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14010edae
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x14010ed93
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x38]
call fcn.140110898
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x140a56b54], eax
mov qword [0x140a56b58], 0
mov eax, dword [rsp + 0x20]
jmp 0x14010edf3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x14010edc8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x14010ed69
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x140a56b60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x140a56b60], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x1401101c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x140125df0]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401101fa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401101ff
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140110248
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140110248
dec r8
sub rdx, 1
jne 0x14011022e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1401113c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140111412
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140111412
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140111412
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140111412
cmp dword [rcx + 0x84], 0xe
jbe 0x140111412
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140111414
xor al, al
add rsp, 0x28
ret
Function at 0x1800016ae
Capabilities:
Print debug messages

Disassembly:
jmp 0x180057204
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne sil
test eax, eax
je 0x180057250
test rbx, rbx
je 0x18005723f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.1800017fd
cmp eax, 1
je 0x180057250
mov eax, 4
jmp 0x180057293
call fcn.1800039bd
cmp eax, 2
jne 0x18005728c
call fcn.18000185c
test al, al
je 0x18005728c
call fcn.180002b1c
test al, al
jne 0x180057282
bts edi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, edi
call fcn.1800039f9
jmp 0x180057293
call fcn.18000389b
mov rcx, rax
jmp 0x180057272
movzx eax, sil
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180002167
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180076ba0
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x18009db78]
xor r11d, r11d
lea rdi, [0x180085744]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x180076c10
mov rax, 0xfffffffffffffffe
jmp 0x180076d5d
cmp word [r10 + 6], r11w
jne 0x180076c7f
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x180076c3a
test r14, r14
je 0x180076c2b
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x180076d5d
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x180076c48
mov r8b, 2
jmp 0x180076c66
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x180076c56
mov r8b, 3
jmp 0x180076c66
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x180076d52
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x180076ca8
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x180076d52
cmp bl, bpl
jb 0x180076d52
cmp bl, r8b
jae 0x180076d52
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x180076cd5
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x180076d52
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x180076cb7
cmp r9, rbp
jae 0x180076d01
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x180076c04
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x180076d52
cmp edx, 0x110000
jae 0x180076d52
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x180076d52
test r14, r14
je 0x180076d40
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.1800039f4
jmp 0x180076d5d
mov rdx, rsi
mov rcx, r10
call fcn.18000405c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800025ef
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800021ad
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x180008a14
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180008aa1
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x180008aa1
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180008aa1
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180008a88
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x180008a82
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x180008a8a
add rdx, 0x28
jmp 0x180008a67
xor edx, edx
test rdx, rdx
jne 0x180008a93
xor al, al
jmp 0x180008aa7
cmp dword [rdx + 0x24], 0
jge 0x180008a9d
xor al, al
jmp 0x180008aa7
mov al, 1
jmp 0x180008aa7
xor al, al
jmp 0x180008aa7
add rsp, 0x18
ret

Function at 0x1800024e6
Capabilities:
Get system information on windows

Disassembly:
jmp 0x18007a030
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18007a05e
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x18007a0b7
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x54]
xor edx, edx
mov r8d, r9d
neg r8
and r8, rbx
lea ecx, [r9 - 1]
mov eax, ecx
and ecx, ebx
and eax, edi
add eax, ecx
dec rax
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add rcx, rax
mov eax, ecx
test ecx, ecx
je 0x18007a0b7
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x18007a0a9
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x18000272a
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x180017578
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1800868b0]
mov ecx, 2
lea r8, [0x1800868a8]
lea rdx, str.FlsGetValue
call fcn.180017048
mov ecx, ebx
test rax, rax
je 0x1800175b2
add rsp, 0x20
pop rbx
jmp qword [0x1800a8020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]