joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000b110
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x10005f610], ecx
mov ecx, 1
sub ecx, 1
nop
add ecx, 1
lea rax, [0x10005f610]
movsxd rdx, ecx
mov r8d, dword [rax + rdx*4 - 4]
mov edx, r8d
shr edx, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
lea r8d, [edx + ecx]
mov edx, ecx
mov dword [rax + rdx*4], r8d
cmp ecx, 0x26f
jl 0x10000b120
mov dword [0x100045a80], 0x270
ret

Function at 0x10000b160
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rsp, [rsp - 0x28]
mov eax, dword [0x10005e010]
cmp eax, dword [0x1000454d0]
je 0x10000b17d
mov dword [0x100045a80], 0x271
cmp dword [0x100045a80], 0x270
jl 0x10000b2e6
cmp dword [0x100045a80], 0x271
jne 0x10000b1b8
mov ecx, dword [0x10005e010]
call fcn.10000b110
mov eax, dword [0x10005e010]
not eax
mov dword [0x10005e010], eax
mov dword [0x1000454d0], eax
mov ecx, 0
sub ecx, 1
add ecx, 1
lea rax, [0x10005f610]
movsxd rdx, ecx
mov edx, dword [rax + rdx*4 + 4]
and edx, 0x7fffffff
mov r8d, ecx
mov eax, dword [rax + r8*4]
and eax, 0x80000000
or eax, edx
mov r9d, eax
lea rax, [0x10005f610]
movsxd rdx, ecx
mov r8d, r9d
shr r8d, 1
mov edx, dword [rax + rdx*4 + 0x634]
xor r8d, edx
mov edx, r9d
and edx, 1
lea r10, [0x100045a90]
mov edx, dword [r10 + rdx*4]
xor edx, r8d
mov r8d, ecx
mov dword [rax + r8*4], edx
cmp ecx, 0xe2
jl 0x10000b1c0
mov ecx, 0xe3
sub ecx, 1
nop
add ecx, 1
lea rax, [0x10005f610]
movsxd rdx, ecx
mov edx, dword [rax + rdx*4 + 4]
and edx, 0x7fffffff
mov r8d, ecx
mov eax, dword [rax + r8*4]
and eax, 0x80000000
or eax, edx
mov r9d, eax
lea rax, [0x10005f610]
movsxd rdx, ecx
mov r8d, r9d
shr r8d, 1
mov edx, dword [rax + rdx*4 - 0x38c]
xor r8d, edx
mov edx, r9d
and edx, 1
lea r10, [0x100045a90]
mov edx, dword [r10 + rdx*4]
xor edx, r8d
mov r8d, ecx
mov dword [rax + r8*4], edx
cmp ecx, 0x26e
jl 0x10000b230
lea rax, [0x10005f610]
mov edx, dword [rax + 0x9bc]
and edx, 0x80000000
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov r9d, eax
shr eax, 1
lea rdx, [0x10005f610]
mov ecx, dword [rdx + 0x630]
xor ecx, eax
and r9d, 1
lea rax, [0x100045a90]
mov eax, dword [rax + r9*4]
xor eax, ecx
mov dword [rdx + 0x9bc], eax
mov dword [0x100045a80], 0
mov edx, dword [0x100045a80]
lea rax, [0x10005f610]
mov eax, dword [rax + rdx*4]
add dword [0x100045a80], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
nop
lea rsp, [rsp + 0x28]
ret
Function at 0x10000d410
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x100045280]
cmp ax, 0xcb
je 0x10000d545
cmp ax, 0xcc
je 0x10000d545
mov rax, qword [0x100060320]
test rax, rax
je 0x10000d44c
mov ecx, dword [0x100060100]
call rax
mov rbx, rax
jmp 0x10000d453
lea rbx, [0x100060108]
cmp word [0x1000600f0], 0
jle 0x10000d47a
lea rcx, [0x1000600c0]
call fcn.10000d730
mov rcx, rbx
call fcn.10000ceb0
mov rcx, rbx
call fcn.10000cf40
mov rsi, qword [rbx]
jmp 0x10000d4aa
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
test rax, rax
jne 0x10000d49d
mov rdx, rsi
mov rcx, rbx
call fcn.10000c100
jmp 0x10000d4a7
mov rax, qword [rsi]
and rax, 0xfffffffffffffffe
mov qword [rsi], rax
mov rsi, rdi
test rsi, rsi
jne 0x10000d480
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x1000600f0], 0
jle 0x10000d545
lea rdx, [0x10005ffd0]
mov rcx, rbx
call fcn.10000c290
mov rsi, rax
test rsi, rsi
je 0x10000d514
mov rax, qword [0x100060070]
mov qword [rsi + 0x18], rax
cmp qword [0x100060070], 0
je 0x10000d506
mov rax, qword [0x100060070]
mov qword [rax + 0x10], rsi
mov rax, qword [rbx + 0xa0]
mov qword [0x100060070], rax
sub word [0x1000600f0], 1
cmp word [0x1000600f0], 0
sete bl
lea rcx, [0x1000600c0]
call fcn.10000d750
test bl, bl
je 0x10000d545
lea rcx, [0x1000600c0]
call fcn.10000d710
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x10000f700
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x138]
mov esi, 0
mov qword [0x10005f3a0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov r8d, 0x104
movabs rcx, 0
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, 0xffffffff
mov byte [rsp + rax + 0x28], 0
mov r8d, ebx
mov rcx, rsp
mov edx, 0
call fcn.10000f8e0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x10005f3a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x28]
call fcn.100002020
call sub.kernel32.dll_GetCommandLineA
mov qword [0x1000452f0], rax
mov r14, rax
jmp 0x10000f888
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x10000f798
cmp byte [r14], 0
je 0x10000f892
mov dil, 0
mov r12, r14
mov ebx, 0
jmp 0x10000f7fa
mov al, byte [r14]
cmp al, 1
jb 0x10000f7f3
sub al, 1
sub al, 0x1f
jbe 0x10000f7d3
sub al, 2
je 0x10000f7dd
jmp 0x10000f7f3
test dil, dil
je 0x10000f800
add ebx, 1
jmp 0x10000f7f6
cmp byte [r14 + 1], 0x22
je 0x10000f7ed
test dil, dil
sete dil
jmp 0x10000f7f6
add r14, 1
jmp 0x10000f7f6
add ebx, 1
add r14, 1
cmp byte [r14], 0
jne 0x10000f7c0
test esi, esi
je 0x10000f885
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.10000f8e0
mov dil, 0
mov r14, r12
mov rdx, qword [0x10005f3a0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x10000f87a
mov al, byte [r14]
cmp al, 1
jb 0x10000f86b
sub al, 1
sub al, 0x1f
jbe 0x10000f843
sub al, 2
je 0x10000f855
jmp 0x10000f86b
test dil, dil
je 0x10000f880
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x10000f876
cmp byte [r14 + 1], 0x22
je 0x10000f865
test dil, dil
sete dil
jmp 0x10000f876
add r14, 1
jmp 0x10000f876
mov al, byte [r14]
mov byte [r13], al
add r13, 1
add r14, 1
cmp byte [r14], 0
jne 0x10000f830
mov byte [r13], 0
add esi, 1
cmp byte [r14], 0
jne 0x10000f79c
mov dword [0x10005f390], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x10005f3a0]
call fcn.10000d1d0
mov rax, qword [0x10005f3a0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x138]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100011be0
Capabilities:
Create process on windows

Disassembly:
jmp qword [sym.imp.kernel32.dll_CreateProcessA]
jmp 0x1000014e0

Function at 0x100011c30
Capabilities:
Get file attributes

Disassembly:
jmp qword [sym.imp.kernel32.dll_GetFileAttributesA]
jmp 0x1000014b0

Function at 0x100011e90
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov edi, 0
mov esi, 1
mov ebx, 6
add ebx, 1
nop
nop
sub ebx, 1
mov eax, ebx
lea rdx, [0x100045d70]
movzx ecx, byte [rdx + rax]
call sub.user32.dll_GetKeyState
movsx eax, ax
mov edx, esi
and edx, eax
test edx, edx
je 0x100011edf
mov eax, ebx
lea rdx, [0x100045d80]
movzx edx, byte [rdx + rax]
or edi, edx
mov esi, 0x8000
test ebx, ebx
jg 0x100011eb0
mov eax, edi
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100014180
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
lea rsp, [rsp - 0x128]
mov rsi, rcx
mov edi, edx
test edi, edi
jne 0x1000141d5
lea rdx, [rsp + 0x20]
mov r8d, 0x105
movabs rcx, 0
call fcn.100011c40
mov ebx, eax
lea r12, [rsp + 0x20]
mov rcx, rsi
call fcn.1000066b0
mov rcx, rsi
mov r9d, 0
mov rdx, r12
mov r8, rbx
call fcn.100007ef0
jmp 0x10001423d
call fcn.100011c20
mov rbx, rax
nop
mov rcx, rbx
call fcn.100014110
mov r12, rax
mov rcx, r12
call fcn.100014130
mov rbx, rax
sub edi, 1
cmp edi, 0
jge 0x1000141e0
mov rax, rbx
sub rax, r12
cmp eax, 2
jl 0x10001421e
cmp byte [r12], 0x22
jne 0x10001421e
cmp byte [rbx - 1], 0x22
jne 0x10001421e
add r12, 1
sub rbx, 1
sub rbx, r12
mov rcx, rsi
call fcn.1000066b0
mov rcx, rsi
mov rdx, r12
mov r9d, 0
mov r8, rbx
call fcn.100007ef0
nop
lea rsp, [rsp + 0x128]
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100014250
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
lea rsp, [rsp - 0x28]
call fcn.100011c20
mov rbx, rax
mov esi, 0xffffffff
jmp 0x100014281
add esi, 1
mov rcx, rbx
call fcn.100014130
mov rbx, rax
mov rcx, rbx
call fcn.100014110
mov rbx, rax
cmp byte [rbx], 0
jne 0x100014268
mov eax, esi
nop
lea rsp, [rsp + 0x28]
pop rsi
pop rbx
ret

Function at 0x100014320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea rsp, [rsp - 0x28]
test rcx, rcx
jne 0x100014331
lea rcx, [0x10005f450]
call fcn.100011c30
cmp eax, 0xffffffff
je 0x100014346
and eax, 0x10
test eax, eax
jne 0x100014346
mov al, 1
jmp 0x100014348
mov al, 0
and eax, 0xff
nop
lea rsp, [rsp + 0x28]
ret

Function at 0x100014db0
Capabilities:
Create thread

Disassembly:
push rbx
lea rsp, [rsp - 0x30]
mov dword [0x1000452a0], 0xffffffff
lea rdx, [0x100048678]
movabs rcx, 0
call fcn.1000120a0
mov rbx, rax
mov byte [rbx + 0x30], 1
mov dword [rsp + 0x20], 4
lea rax, [rbx + 0x40]
mov qword [rsp + 0x28], rax
lea r8, [0x100014d90]
mov r9, rbx
movabs rdx, 0
movabs rcx, 0
call sub.kernel32.dll_CreateThread
mov rdx, rax
mov rax, rbx
mov qword [rax + 0x38], rdx
nop
lea rsp, [rsp + 0x30]
pop rbx
ret

Function at 0x100014fa0
Capabilities:
Resume thread

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov rbx, rcx
mov byte [rbx + 0x30], 0
mov rcx, qword [rbx + 0x38]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x100014fc1
mov byte [rbx + 0x30], 1
jmp 0x100014fd2
cmp qword [rbx + 0x58], 0
je 0x100014fd2
mov rcx, qword [rbx + 0x60]
mov rdx, rbx
call qword [rbx + 0x58]
nop
lea rsp, [rsp + 0x20]
pop rbx
ret

Function at 0x100015050
Capabilities:
Terminate thread

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov rbx, rcx
mov rcx, qword [rbx + 0x38]
mov edx, 0
call sub.kernel32.dll_TerminateThread
mov byte [rbx + 0x31], 1
nop
lea rsp, [rsp + 0x20]
pop rbx
ret
Function at 0x100017510
Capabilities:
Hide graphical window

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov rbx, rcx
mov eax, dword [rbx + 0x44]
and eax, 0xefffffff
mov dword [rbx + 0x44], eax
test dl, dl
je 0x10001752f
or dword [rbx + 0x44], 0x10000000
test dl, dl
je 0x100017539
or byte [rbx + 0x47], 0x10
jmp 0x10001753d
and byte [rbx + 0x47], 0xef
cmp qword [rbx + 0x38], 0
je 0x10001757c
test dl, dl
je 0x100017561
mov rcx, rbx
call qword [0x100045cd0]
mov rcx, qword [rbx + 0x38]
mov edx, 5
call sub.user32.dll_ShowWindow
jmp 0x10001757c
and byte [rbx + 0x63], 0xfe
mov rcx, qword [rbx + 0x38]
mov edx, 0
call sub.user32.dll_ShowWindow
mov rcx, rbx
call qword [0x100045cd0]
nop
lea rsp, [rsp + 0x20]
pop rbx
ret

Function at 0x10001dc20
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
push rsi
lea rsp, [rsp - 0x1c8]
mov rbx, rcx
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call sub.wsock32.dll_WSAStartup
mov rcx, rsi
test rcx, rcx
jne 0x10001dc4e
lea rcx, [0x10005f450]
call sub.wsock32.dll_gethostbyname
test rax, rax
je 0x10001dc80
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rsp + 0x1b8], eax
mov ecx, eax
call sub.wsock32.dll_inet_ntoa
mov rdx, rax
mov rcx, rbx
mov r8d, 0
call fcn.100007200
nop
lea rsp, [rsp + 0x1c8]
pop rsi
pop rbx
ret

Function at 0x100034b60
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
mov ebx, 1
sub ebx, 1
nop
nop
add ebx, 1
mov eax, ebx
lea rdx, [0x100060f20]
lea rcx, [rdx + rax*8 - 8]
movabs rdx, 0
call fcn.100006720
mov eax, ebx
lea rdx, [0x100060f60]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100034b88
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0x10]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
cmp eax, 0
jle 0x100034c4c
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x18]
mov r9d, 0
movabs r8, 0xa
call fcn.1000072c0
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.10002cf90
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100034c4b
lea rcx, [0x1000349e0]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x100034aa0]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop
mov rcx, rbp
call fcn.100034b40
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000414d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x30]
mov rbx, rcx
mov si, dx
mov rdi, r8
cmp qword [rbx + 0x18], 0
jne 0x100041593
mov r8d, 0
mov edx, 1
mov ecx, 2
call sub.wsock32.dll_socket
mov qword [rbx + 0x18], rax
mov byte [rbx + 0x20], 0
mov word [rsp + 0x20], 2
mov cx, si
and ecx, 0xffff
call sub.wsock32.dll_htons
mov word [rsp + 0x22], ax
mov rcx, rdi
test rcx, rcx
jne 0x100041532
lea rcx, [0x10005f450]
call sub.wsock32.dll_inet_addr
mov dword [rsp + 0x24], eax
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x10
call sub.wsock32.dll_connect
test eax, eax
je 0x100041566
mov rcx, qword [rbx + 0x18]
call sub.wsock32.dll_closesocket
mov qword [rbx + 0x18], 0
jmp 0x100041593
mov rcx, qword [rbx + 0x18]
mov rdx, qword [0x100186060]
mov r9d, 0x23
mov r8d, 0x400
call sub.wsock32.dll_WSAAsyncSelect
cmp qword [rbx + 0x40], 0
je 0x100041593
mov rcx, qword [rbx + 0x48]
mov rdx, rbx
call qword [rbx + 0x40]
nop
lea rsp, [rsp + 0x30]
pop rsi
pop rdi
pop rbx
ret

Function at 0x100041640
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
push rsi
push r12
lea rsp, [rsp - 0x28]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
jmp 0x10004169c
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
mov r8d, edi
mov r9d, 0
call sub.wsock32.dll_send
mov r12d, eax
cmp r12d, 0xffffffff
jne 0x100041688
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1000416a8
mov byte [rbx + 0x20], 1
jmp 0x10004169c
mov eax, r12d
sub edi, eax
mov eax, esi
movsxd rax, eax
movsxd rdx, r12d
lea rax, [rax + rdx]
mov rsi, rax
cmp qword [rbx + 0x18], 0
je 0x1000416a8
cmp edi, 0
ja 0x100041658
nop
lea rsp, [rsp + 0x28]
pop r12
pop rsi
pop rdi
pop rbx
ret
Function at 0x100042020
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x120]
mov qword [rbp - 0xd0], rbx
mov qword [rbp - 0xc8], rdi
mov qword [rbp - 0xc0], rsi
mov qword [rbp - 0xb8], r12
mov qword [rbp - 0xb0], r13
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r12, r9
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
nop
movabs r13, 0
mov dword [rbx + 0x54], 0
lea rcx, [rbp - 0x68]
mov r8d, 0
movabs rdx, 0x68
call fcn.100002320
mov dword [rbp - 0x68], 0x68
mov dword [rbp - 0x2c], 1
movzx ax, byte [rbx + 0x68]
mov word [rbp - 0x28], ax
lea rcx, [rbp - 0x90]
call fcn.1000066b0
mov qword [rbp - 0xa8], rsi
lea rax, [0x100052e68]
mov qword [rbp - 0xa0], rax
mov qword [rbp - 0x98], rdi
lea rdx, [rbp - 0xa8]
lea rcx, [rbp - 0x90]
mov r9d, 0
movabs r8, 2
call fcn.100006b50
mov rdx, qword [rbp - 0x90]
lea rcx, [rbp - 0x88]
call fcn.100013e20
mov rdx, qword [rbp - 0x88]
test rdx, rdx
jne 0x100042124
lea rdx, [0x10005f450]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
movabs r9, 0
movabs r8, 0
movabs rcx, 0
call fcn.100011be0
test eax, eax
je 0x10004218e
mov eax, dword [rbp - 0x70]
mov dword [rbx + 0x54], eax
mov r13, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
call sub.kernel32.dll_CloseHandle
nop
mov rcx, rbp
call fcn.100041ff0
mov rax, r13
mov rbx, qword [rbp - 0xd0]
mov rdi, qword [rbp - 0xc8]
mov rsi, qword [rbp - 0xc0]
mov r12, qword [rbp - 0xb8]
mov r13, qword [rbp - 0xb0]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1400010e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
lea rsi, [rdx + 0x1824a18]
lea r14, [rdx + 0x19beed0]
xor r15d, r15d
nop word [rax + rax]
lea rdx, str.Counter_Strike_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rbx
je 0x140001150
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], 0xa
call fcn.140001310
jmp 0x140001120
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14000113d
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x31]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x31]
lea r8, [rbp - 0x19]
add rdx, 0x13a8
mov qword [rsp + 0x20], r15
mov r9d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [rbp - 0x19]
test ebx, ebx
jle 0x1400012f0
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x29]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x29]
lea r8, [rbp - 0x21]
mov eax, ebx
mov qword [rsp + 0x20], r15
sar eax, 9
add rdx, 0x10
shl eax, 3
mov r9d, 8
movsxd rcx, eax
add rdx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
and ebx, 0x1ff
mov qword [rsp + 0x20], r15
imul edx, ebx, 0x78
lea r8, [rbp - 9]
mov r9d, 8
mov rcx, rdi
add rdx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x1400012f0
lea rdx, [rbx + 0x3c3]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x11]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x31]
lea r8, [rbp - 0x15]
add rdx, 0x3c3
mov qword [rsp + 0x20], r15
mov r9d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rdx, [rbx + 0x324]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0xd]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 0x15]
cmp dword [rbp - 0x11], eax
je 0x1400012f0
cmp dword [rbp - 0xd], r15d
jle 0x1400012f0
xorps xmm0, xmm0
mov dword [rbp - 1], r15d
xorps xmm1, xmm1
mov dword [rbp + 0x13], 2
mov r8d, 0x28
lea rdx, [rbp - 1]
mov ecx, 1
movdqu xmmword [rbp + 3], xmm0
movdqu xmmword [rbp + 0x17], xmm1
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], 1
call fcn.140001310
mov r8d, 0x28
mov dword [rbp + 0x13], 4
lea rdx, [rbp - 1]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], 1
call fcn.140001310
jmp 0x140001120
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140009790]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400097a0]
mov dword [rax], 1
mov rax, qword [0x1400097b0]
mov dword [rax], 1
mov rax, qword [0x140009740]
cmp word [rax], 0x5a4d
jne 0x14000105e
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c8
mov rax, qword [0x140009780]
mov dword [0x14000c00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b8
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140009860]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140009840]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400096f0]
cmp dword [rax], 1
je 0x140001100
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x14000107b
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001118
cmp dx, 0x20b
jne 0x14000105e
cmp dword [rax + 0x84], 0xe
jbe 0x14000105e
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105e
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x20
pop rbp
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105e
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105e

Function at 0x1400014d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
call dbg.__main
mov byte [rbp - 1], 0x63
mov byte [rbp - 2], 0x79
mov byte [rbp - 3], 0x62
mov byte [rbp - 4], 0x65
mov byte [rbp - 5], 0x72
mov byte [rbp - 6], 0x70
mov byte [rbp - 7], 0x75
mov byte [rbp - 8], 0x6e
mov byte [rbp - 9], 0x6b
movsx r11d, byte [rbp - 9]
movsx r10d, byte [rbp - 8]
movsx r9d, byte [rbp - 7]
movsx r8d, byte [rbp - 6]
movsx ecx, byte [rbp - 5]
movsx edx, byte [rbp - 4]
movsx esi, byte [rbp - 3]
movsx ebx, byte [rbp - 2]
movsx eax, byte [rbp - 1]
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, esi
mov r8d, ebx
mov edx, eax
lea rax, str._c_c_c_c_c_c_c_c_c
mov rcx, rax
call sym.printf
mov eax, 0
add rsp, 0x60
pop rbx
pop rsi
pop rbp
ret

Function at 0x140001860
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x1400018d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x14000c0a4]
mov rbx, rcx
test esi, esi
jle 0x140001a00
mov rax, qword [0x14000c0a8]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000191b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400019a3
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001900
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x140001a22
mov rax, qword [0x14000c0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000c0a8]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a07
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000199c
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400019b0
add dword [0x14000c0a4], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000c0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000199c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop word [rax + rax]
xor esi, esi
jmp 0x140001928
mov rax, qword [0x14000c0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001fb0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x14000c100]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c0e0]
test rbx, rbx
je 0x140002015
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000200c
test eax, eax
jne 0x14000200c
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001ff0
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002268
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002270
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret