joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140180c21
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401e72e0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1405b00d2]
call fcn.140183b29
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140499e70]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401e7425
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401e7379
mov dword [rbp + 0x160], 1
jmp 0x1401e7383
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401e7420
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401e73fa
cmp qword [rbp + 0x198], 2
jb 0x1401e73fa
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e73fa
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e73fa
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401e7344
jmp 0x1401e74bf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401e74bf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401e7496
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e7496
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401e7496
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401e7425
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140180f78
Capabilities:
Parse pe header

Disassembly:
jmp 0x140359a30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140359a50
xor al, al
jmp 0x140359ad1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140359a63
xor al, al
jmp 0x140359ad1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140359a8d
xor al, al
jmp 0x140359ad1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140359aa1
xor al, al
jmp 0x140359ad1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140359ab3
xor al, al
jmp 0x140359ad1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140359acf
xor al, al
jmp 0x140359ad1
mov al, 1
add rsp, 0x38
ret
Function at 0x140181d06
Capabilities:
Terminate process

Disassembly:
jmp 0x14037ddb0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14037ddde
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1401830de
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14018264d
Capabilities:
Create directory

Disassembly:
jmp 0x1402f64a0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14057dc40]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402f64dd
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1402f6552
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1402f6540
mov edx, 1
mov ecx, 2
call fcn.14017b48d
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14017d76a
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402f6540
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.14017c0cc
movzx eax, al
test eax, eax
jne 0x1402f6540
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14017f2bd
add rsp, 0x68
ret

Function at 0x14018305c
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401e71c0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1405b00d2]
call fcn.140183b29
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140499e70]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1401e723f
mov dword [rbp + 0x120], 1
jmp 0x1401e7249
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1401e7292
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1401e720a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1401831ab
Capabilities:
Print debug messages

Disassembly:
jmp 0x1404329f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140183408
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14037cb30
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14037c480
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14037cb79
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1405b2020]
jmp 0x14037cb88
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14018358e
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402ee7f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, ILFree
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x428]
mov rax, qword [0x14057dc40]
xor rax, rbp
mov qword [rbp + 0x3d8], rax
mov dword [rbp + 0x3c4], 0
lea rcx, [0x1405b05fb]
call fcn.140183b29
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1402ee878
mov rcx, qword [rbp + 0x400]
call fcn.140181b2b
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
jmp 0x1402ee8b2
mov r8d, 0x80
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x400]
call fcn.14017decc
mov eax, dword [rbp + 0x3c4]
or eax, 1
mov dword [rbp + 0x3c4], eax
mov rax, qword [rbp + 0x400]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14050a970]
call fcn.1401822a6
mov rax, rdi
mov rcx, qword [rbp + 0x3d8]
xor rcx, rbp
call fcn.14017f2bd
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret
Function at 0x140183a2f
Capabilities:
Create thread

Disassembly:
jmp 0x14040bff0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14040c01c
mov dword [rsp + 0x30], 1
jmp 0x14040c024
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14040c06d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x14050fb70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.14017bf8c
cmp eax, 1
jne 0x14040c06d
int3
cmp dword [rsp + 0x34], 0
jne 0x14040c0af
call fcn.14017e1ce
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.1401826de
xor eax, eax
jmp 0x14040c1af
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14040bae0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14040b8e0
lea rcx, [rsp + 0x40]
call fcn.14040b950
movzx eax, al
test eax, eax
jne 0x14040c0ff
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14040b930
mov rax, qword [rsp + 0x50]
jmp 0x14040c1af
lea rcx, [rsp + 0x40]
call fcn.14040bc90
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x14040b690]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14040c173
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14017d878
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.14040b930
mov rax, qword [rsp + 0x58]
jmp 0x14040c1af
cmp qword [rsp + 0xa8], 0
je 0x14040c18c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.14040bc50
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.14040b930
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret

Function at 0x14018451f
Capabilities:
Move file

Disassembly:
jmp 0x1402f7c20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 3
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1402f7c4c
xor eax, eax
jmp 0x1402f7c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x28
ret
Function at 0x140440ca0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14017c90a
sub rsp, rax
mov rax, qword [0x14057dc40]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14058b750]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140440e92
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140440de6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140440de6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140440dcb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140440d68
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140440e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140440eb1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140440e8d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140440eb1
jmp 0x140440d3e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14017f2bd
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140440f60
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14017c90a
sub rsp, rax
mov rax, qword [0x14057dc40]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14058b750]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14044116d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1404410b9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1404410b9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140441099
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140441028
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14044112d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14044118c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140441168
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14044118c
jmp 0x140440ffe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14017f2bd
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x9b2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009b21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x9b2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x9b206f
add dl, dl
jne 0x9b2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x9b20f6
xor eax, eax
add dl, dl
jne 0x9b20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x9b21ad
add dl, dl
jne 0x9b20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x9b20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x9b207e
mov eax, 1
add dl, dl
jne 0x9b2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9b2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x9b20fb
sub eax, ebx
mov ebx, 1
jne 0x9b214c
mov ecx, 1
add dl, dl
jne 0x9b212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x9b2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x9b207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9b2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9b2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x9b215d
cmp eax, 0x7d00
jae 0x9b219b
cmp eax, 0x500
jb 0x9b2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x9b207e
cmp eax, 0x7f
ja 0x9b219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x9b207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x9b21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x9b207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400056cc
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call fcn.14001cc18
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call fcn.14001bb54
test eax, eax
je 0x140005779
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call fcn.140038264
test eax, eax
je 0x14000576f
mov dword [rsp + 0x40], 1
mov eax, listen
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + rax + 0x44], rcx
mov eax, listen
imul rax, rax, 0
mov dword [rsp + rax + 0x4c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.14001b50c
mov rcx, qword [rsp + 0x30]
call fcn.14001e60c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140089130
add rsp, 0x68
ret
Function at 0x140007ec4
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp], 0xffffffff
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x140007f57
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov dword [rsp + 8], 7
jmp 0x140007f22
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x140007f4b
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x140007f18
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x140007edc
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14000de0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400e30a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x20], 0
mov ecx, 3
call fcn.14003d5fc
call fcn.14003d67c
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x78]
call fcn.14007c01c
mov r8, rax
mov edx, 0x2712
mov rcx, qword [rsp + 0x28]
call fcn.14003fbcc
lea r8, [0x14002e964]
mov edx, 0x4e2b
mov rcx, qword [rsp + 0x28]
call fcn.14003fbcc
mov r8, qword [rsp + 0x70]
mov edx, 0x2711
mov rcx, qword [rsp + 0x28]
call fcn.14003fbcc
mov eax, 1
imul rax, rax, 0x11
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x12
jae 0x14000dea0
jmp 0x14000dea5
call fcn.140088f10
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x40], 0
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x40], 0x2e
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x75
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], WSASetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x40], WSASetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0x67
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], WSACleanup
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], WSASetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x40], 0x31
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x62
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], 0x2d
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], 0x63
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x40], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x40], 0x30
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x40], 0x2f
lea r8, [rsp + 0x40]
mov edx, 0x2722
mov rcx, qword [rsp + 0x28]
call fcn.14003fbcc
mov rcx, qword [rsp + 0x28]
call fcn.14003d834
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000dfc8
jmp 0x14000dfcd
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x28]
call fcn.14003d83c
mov al, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
mov rcx, qword [rsp + 0x78]
call fcn.14007b934
mov al, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140089130
add rsp, 0x68
ret
Function at 0x140016480
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret