joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140026a49
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140026b37
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140026adf
cmp qword [rsp + 0x20], 0
jle 0x140026adf
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140026a89
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140005490
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140026b27
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140026b27
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14002b1f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0xc18
lea rcx, [rsp + 0x40]
call fcn.14000f570
nop
lea rdx, str._injector____init__Loading...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005e40
mov qword [rsp + 0x30], rax
lea rdx, [0x14000ec60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
call fcn.1400177d0
movzx eax, al
test eax, eax
jne 0x14002b28a
lea rdx, str._injector____init__Failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005e40
mov qword [rsp + 0x38], rax
lea rdx, [0x14000ec60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call fcn.140011290
mov eax, dword [rsp + 0x20]
jmp 0x14002b2c1
lea rcx, [rsp + 0x40]
call fcn.140017570
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x40]
call fcn.140026150
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.140011290
mov eax, dword [rsp + 0x24]
add rsp, 0xc18
ret
Function at 0x14002c190
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2278
call fcn.14021d620
sub rsp, rax
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x28]
mov r8d, 0x2000
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x2288]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14002c2a9
mov dword [rsp + 0x20], 0
jmp 0x14002c1f0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x28]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jae 0x14002c2a9
mov eax, dword [rsp + 0x20]
mov r9d, 0x104
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + rax*8 + 0x270]
mov rcx, qword [rsp + 0x2288]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x14002c2a4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140007ba0
xor r8d, r8d
mov rdx, qword [rsp + 0x2290]
lea rcx, [rsp + 0x38]
call fcn.1400170e0
cmp rax, 0xffffffffffffffff
je 0x14002c29a
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x2280]
call fcn.140026dc0
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x38]
call fcn.1400116f0
mov rax, qword [rsp + 0x2280]
jmp 0x14002c2c9
lea rcx, [rsp + 0x38]
call fcn.1400116f0
jmp 0x14002c1e6
mov rcx, qword [rsp + 0x2280]
call fcn.140010050
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x2280]
add rsp, 0x2278
ret

Function at 0x140031590
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x811c9dc5
mov qword [rsp + 8], 0
jmp 0x1400315bd
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
cmp qword [rsp + 8], rax
jae 0x1400315f3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 8]
movzx eax, byte [rax + rcx]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x1000193
mov dword [rsp], eax
jmp 0x1400315b0
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x140053100
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x811c9dc5
mov qword [rsp + 8], 0
jmp 0x14005312d
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 8], rax
jae 0x140053162
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x1000193
mov dword [rsp], eax
jmp 0x140053120
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x14005e960
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x811c9dc5
mov qword [rsp + 8], 0
jmp 0x14005e98d
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x80]
cmp qword [rsp + 8], rax
jae 0x14005e9c2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x1000193
mov dword [rsp], eax
jmp 0x14005e980
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x14009b890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
mov r8, qword [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x28
ret

Function at 0x1400a83c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x60], 0
je 0x1400a8506
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
cmp qword [rax + 8], rcx
jb 0x1400a8506
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax]
cmp eax, 5
jge 0x1400a8442
lea r9, [0x1402ade28]
mov r8d, 0x8c
lea rdx, [0x1402ade40]
lea rcx, [0x1402ade88]
call fcn.14002e330
test eax, eax
je 0x1400a8442
int3
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
and eax, 4
test eax, eax
jne 0x1400a8470
mov rax, qword [rsp + 0x20]
add rax, 0x10
mov rcx, qword [rsp + 0x20]
cmp qword [rcx + 8], rax
jne 0x1400a8497
lea r9, [0x1402adea8]
mov r8d, 0x8d
lea rdx, [0x1402adec0]
lea rcx, str._isblack_o___upisopen_uv_
call fcn.14002e330
test eax, eax
je 0x1400a8497
int3
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
and eax, 0xb
mov rcx, qword [rsp + 0x30]
movzx ecx, byte [rcx + 0x20]
xor ecx, 3
and ecx, 3
cmp eax, ecx
jne 0x1400a84dd
lea r9, str.luaF_close
mov r8d, 0x8e
lea rdx, [0x1402adf40]
lea rcx, str._isdead_g__o_
call fcn.14002e330
test eax, eax
je 0x1400a84dd
int3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
mov qword [rax + 0x60], rcx
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.1400a8510
jmp 0x1400a83dc
add rsp, 0x48
ret
Function at 0x1400b9b50
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x10
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
imul eax, dword [rsp + 0x20], 0x85ebca6b
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xd
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
imul eax, dword [rsp + 0x20], 0xc2b2ae35
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x10
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 6]
mov ecx, 1
mov dword [rsp + 0x24], ecx
movzx ecx, al
mov eax, dword [rsp + 0x24]
shl eax, cl
mov rcx, qword [rsp + 0x50]
movzx ecx, byte [rcx + 6]
mov edx, 1
shl edx, cl
mov ecx, edx
dec ecx
and eax, ecx
test eax, eax
je 0x1400b9c21
lea r9, str.hashpointer
mov r8d, 0x49
lea rdx, [0x1402bca50]
lea rcx, [0x1402bcab0]
call fcn.14002e330
test eax, eax
je 0x1400b9c21
int3
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 6]
mov ecx, 1
mov dword [rsp + 0x28], ecx
movzx ecx, al
mov eax, dword [rsp + 0x28]
shl eax, cl
dec eax
mov ecx, dword [rsp + 0x20]
and ecx, eax
mov eax, ecx
cdqe
imul rax, rax, 0x20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
add rsp, 0x48
ret
Function at 0x1401ccac0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4b8
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1401ccbb8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1401ccbb8
mov qword [rsp + 0x20], 0
jmp 0x1401ccb45
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x4d8]
call fcn.140052be0
cmp qword [rsp + 0x20], rax
jae 0x1401ccbb3
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x4d8]
call fcn.140040a30
mov rcx, rax
call fcn.140015ec0
mov rdx, rax
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401ccbb1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x30]
mov rdi, qword [rsp + 0x4d0]
mov rsi, rax
mov ecx, 0x238
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x4d0]
jmp 0x1401ccbf9
jmp 0x1401ccb38
jmp 0x1401ccb15
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x270]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea rax, [rsp + 0x270]
mov rdi, qword [rsp + 0x4d0]
mov rsi, rax
mov ecx, 0x238
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x4d0]
add rsp, 0x4b8
pop rdi
pop rsi
ret
Function at 0x1401ccc10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
lea rcx, [rsp + 0xb0]
call fcn.1401ccee0
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400068b0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
call fcn.140008cd0
mov qword [rsp + 0x68], rax
jmp 0x1401ccc6a
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x28], rax
je 0x1401ccec0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [0x1402f79a0]
lea rcx, [rsp + 0xe8]
call fcn.140007ba0
nop
lea rdx, [0x1402f79a4]
lea rcx, [rsp + 0xc8]
call fcn.140007ba0
nop
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140015ec0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
call fcn.140015f10
mov qword [rsp + 0x70], rax
jmp 0x1401ccce6
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x30], rax
je 0x1401ccd1e
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movzx edx, ax
lea rcx, [rsp + 0xe8]
call fcn.1400126f0
jmp 0x1401cccd8
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140015ec0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x58]
call fcn.140015f10
mov qword [rsp + 0x78], rax
jmp 0x1401ccd59
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x38], rax
je 0x1401ccd91
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movzx edx, ax
lea rcx, [rsp + 0xc8]
call fcn.1400126f0
jmp 0x1401ccd4b
xor r8d, r8d
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xe8]
call fcn.1400170e0
cmp rax, 0xffffffffffffffff
je 0x1401ccea0
cmp qword [rsp + 0x128], 0
je 0x1401cce5c
mov r8d, 0x1000
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x98]
call fcn.14000ef60
lea rcx, [rsp + 0x98]
call fcn.140016950
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x98]
call fcn.140016950
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
add rax, 0x18
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x60]
add rax, 4
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x38]
mov rcx, qword [rsp + 0x128]
mov qword [rcx], rax
lea rcx, [rsp + 0x98]
call fcn.140011860
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xc8]
call fcn.1400116f0
nop
lea rcx, [rsp + 0xe8]
call fcn.1400116f0
nop
lea rcx, [rsp + 0xb0]
call fcn.1401cc880
mov rax, qword [rsp + 0x90]
jmp 0x1401ccecf
lea rcx, [rsp + 0xc8]
call fcn.1400116f0
nop
lea rcx, [rsp + 0xe8]
call fcn.1400116f0
jmp 0x1401ccc5c
lea rcx, [rsp + 0xb0]
call fcn.1401cc880
xor eax, eax
add rsp, 0x118
ret
Function at 0x1401ccee0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x22a8
call fcn.14021d620
sub rsp, rax
mov dword [rsp + 0x24], 0
mov rcx, qword [rsp + 0x22b0]
call fcn.140010420
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea r9, [rsp + 0x28]
mov r8d, 0x2000
lea rdx, [rsp + 0x2a0]
mov rcx, qword [0x140338930]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1401cd002
mov dword [rsp + 0x20], 0
jmp 0x1401ccf52
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x28]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
jae 0x1401cd002
mov eax, dword [rsp + 0x20]
mov r9d, 0x104
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + rax*8 + 0x2a0]
mov rcx, qword [0x140338930]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x1401ccffd
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140007ba0
nop
mov eax, dword [rsp + 0x20]
lea rax, [rsp + rax*8 + 0x2a0]
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1401cc2a0
nop
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x22b0]
call fcn.1401cd490
nop
lea rcx, [rsp + 0x60]
call fcn.140011cb0
nop
lea rcx, [rsp + 0x40]
call fcn.1400116f0
jmp 0x1401ccf48
mov rax, qword [rsp + 0x22b0]
add rsp, 0x22a8
ret
Function at 0x1401d04a0
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [rsp + 8], ecx
mov eax, dword [rsp + 8]
shr eax, 0xf
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0x85ebca77
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
shr eax, 0xd
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0xc2b2ae3d
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
shr eax, 0x10
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
ret
Function at 0x14021c900
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14021c984
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140301c50]
cmp byte [rcx + rax], 0
je 0x14021c984
dec r8
sub rdx, 1
jne 0x14021c96a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14021dfb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14021dffe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14021dffe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14021dffe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14021dffe
cmp dword [rcx + 0x84], 0xe
jbe 0x14021dffe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14021e000
xor al, al
add rsp, 0x28
ret
Function at 0x401290
Capabilities:
Extract cabinet on windows

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r9, [sym.cabinet_read]
lea r8, [sym.cabinet_open]
xor r14d, r14d
lea rax, [rsp + 0x54]
mov dword [rsp + 0x38], 0
mov rsi, rcx
mov rbx, rdx
mov qword [rsp + 0x40], rax
lea rax, [sym.cabinet_seek]
lea rdx, [sym.cabinet_free]
mov qword [rsp + 0x30], rax
lea rax, [sym.cabinet_close]
lea rcx, [sym.cabinet_alloc]
mov qword [rsp + 0x28], rax
lea rax, [sym.cabinet_write]
mov qword [rsp + 0x20], rax
call sym.FDICreate
mov r12, rax
test rax, rax
je 0x4013cc
test rsi, rsi
je 0x4013e0
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov ecx, eax
mov r14, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r13, rax
test rax, rax
je 0x4013e0
mov dword [rsp + 0x28], r14d
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call rdi
lea rax, [sym.cabinet_notify]
mov rcx, r12
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.FDICopy
mov rcx, r13
mov r14d, eax
call qword [sym.imp.ucrtbase.dll_free]
mov rcx, r12
call sym.FDIDestroy
mov eax, r14d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
xor r14d, r14d
jmp 0x4013c4

Function at 0x401720
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov r12, rcx
test rcx, rcx
je 0x401818
lea rdx, [0x0040a008]
call sym.path_combine.part.0
mov r14, rax
test rax, rax
je 0x401818
lea rdi, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
mov rcx, r14
mov r14, qword [sym.imp.ucrtbase.dll_free]
mov r13, rax
call r14
cmp r13, 0xffffffffffffffff
je 0x4017f6
mov rsi, qword [sym.imp.ucrtbase.dll_wcscmp]
lea rbx, [rsp + 0x5c]
lea rbp, [0x0040a010]
lea r15, [0x0040a014]
mov rdx, rbp
mov rcx, rbx
call rsi
test eax, eax
je 0x4017dd
mov rdx, r15
mov rcx, rbx
call rsi
test eax, eax
je 0x4017dd
mov rcx, r12
mov rdx, rbx
call sym.path_combine.part.0
mov rcx, rax
test rax, rax
je 0x4017dd
test byte [rsp + 0x30], 0x10
mov qword [rsp + 0x28], rax
jne 0x401820
call qword [sym.imp.kernel32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x28]
call r14
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x401798
mov rcx, r13
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, r12
call qword [sym.imp.kernel32.dll_RemoveDirectoryW]
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x4017ff
call sym.delete_directory
mov rcx, qword [rsp + 0x28]
jmp 0x4017da
Function at 0x401830
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401848
test al, 0x10
jne 0x401878
xor edx, edx
mov rcx, r12
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x401878
mov rax, qword gs:[0x30]
cmp dword [rax + 0x68], 0xb7
sete al
movzx eax, al
add rsp, 0x20
pop r12
ret
mov eax, 1
add rsp, 0x20
pop r12
ret

Function at 0x401890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
call qword [sym.imp.ucrtbase.dll__wcsdup]
mov r12, rax
test rax, rax
je 0x401949
mov rcx, rax
call qword [sym.imp.shlwapi.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x4018d8
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_free]
mov eax, r13d
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r12
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4018f0
mov r13d, 1
test al, 0x10
jne 0x4018bb
movzx eax, word [r12]
test ax, ax
je 0x401939
mov rbx, r12
jmp 0x40190d
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
je 0x401939
cmp ax, 0x5c
jne 0x401900
xor edx, edx
mov rcx, r12
mov word [rbx], dx
call sym.create_directory
test eax, eax
je 0x4018b8
mov eax, 0x5c
add rbx, 2
mov word [rbx - 2], ax
movzx eax, word [rbx]
test ax, ax
jne 0x40190d
mov rcx, r12
call sym.create_directory
mov r13d, eax
jmp 0x4018bb
xor r13d, r13d
jmp 0x4018c4