joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ed4b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [0x180202de0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x180202de4], eax
mov eax, dword [rsp + 0x48]
mov dword [0x180202de8], eax
mov dword [rsp + 0x60], ebx
mov byte [0x180202ded], bl
call fcn.1800ee740
test al, al
je 0x1800ed51e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
je 0x1800ed51e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x1800ed51e
inc eax
mov byte [0x180202ded], 1
mov dword [0x180202e70], eax
mov byte [0x180202dee], bl
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov edi, 1
test eax, eax
jne 0x1800ed55b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800ed55b
movzx eax, word [rsp + 0x60]
jmp 0x1800ed562
mov eax, edi
mov word [rsp + 0x60], ax
cmp ax, di
seta cl
call fcn.1800ee630
test al, al
je 0x1800ed58b
call fcn.1800ed290
test al, al
je 0x1800ed58b
cmp dword [0x180202e74], edi
seta al
mov byte [0x180202dee], al
jmp 0x1800ed592
movzx eax, byte [0x180202dee]
test al, al
je 0x1800ed5e0
mov r9d, dword [0x180202e78]
test r9, r9
je 0x1800ed663
lea r8, [0x180202df0]
nop dword [rax]
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
inc rbx
mov rax, qword [rdx]
bts rax, rcx
mov qword [rdx], rax
cmp rbx, r9
jb 0x1800ed5b0
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x1800ed663
mov r9, qword [rsp + 0x60]
lea r8, [0x180202df0]
nop dword [rax]
test r9, rdi
je 0x1800ed631
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rcx
mov qword [rdx], rax
rol rdi, 1
test r9, rdi
je 0x1800ed656
lea rdx, [rbx + 1]
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rdx
mov qword [rcx], rax
rol rdi, 1
add rbx, 2
cmp rbx, 0x40
jb 0x1800ed610
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x180138340
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.180135fe0
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.180136710
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.180136e40
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.180136e40

Function at 0x180138460
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.180136710
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.180135fe0
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.180137040
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.180137040
Function at 0x180139b40
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.180138340
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.180136710
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.180138580
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.180136e40
Function at 0x18013ba40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.180138340
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.180138460
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.180138580
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.180138580
Function at 0x180140670
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180140698
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180140698
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000232a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000232a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000232a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000232a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000232a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000232c
xor al, al
add rsp, 0x28
ret
Function at 0x1400badf6
Capabilities:
Terminate process

Disassembly:
jmp 0x140227920
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400bb26f
Capabilities:
Write file on windows

Disassembly:
jmp 0x14012bae0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402c9204]
call fcn.1400bc700
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400bb32d
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1401c1010
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ace40]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1402c93a7]
call fcn.1400bc700
nop
call fcn.1400bb990
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [0x1402b57a0]
call qword [sym.imp.USER32.dll_GetClientRect]
nop
mov eax, dword [rbp + 0x2c]
mov ecx, dword [rbp + 0x34]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x30]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rbp + 0x154]
call fcn.1400bb238
mov rax, qword [rax]
mov rcx, qword [rbp + 8]
mov qword [rcx + 8], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
mov rax, qword [0x1402b57a8]
mov rcx, qword [rbp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1402b57b0]
divss xmm0, xmm1
mov rax, qword [rbp + 8]
movss dword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x58]
mov qword [0x1402b57a8], rax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401c1102
mov dword [rbp + 0x164], 1
jmp 0x1401c110c
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0xe0c], cl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401c113e
mov dword [rbp + 0x164], 1
jmp 0x1401c1148
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0xe0d], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401c117a
mov dword [rbp + 0x164], 1
jmp 0x1401c1184
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0xe0e], cl
mov rax, qword [rbp + 8]
mov byte [rax + 0xe0f], 0
call fcn.1401c1460
nop
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x70]
test eax, eax
je 0x1401c11be
mov dword [rbp + 0x164], 0xffffffff
jmp 0x1401c11c9
call fcn.1400bae32
mov dword [rbp + 0x164], eax
mov eax, dword [rbp + 0x164]
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x74]
cmp dword [0x1402acb78], eax
je 0x1401c11ec
mov eax, dword [rbp + 0x74]
mov dword [0x1402acb78], eax
call fcn.1401c12e0
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14027a520]
call fcn.1400bbd82
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400ba9f0
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x1400bb43b
Capabilities:
Read file on windows

Disassembly:
jmp 0x14012ba60
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402c9204]
call fcn.1400bc700
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400bb454
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14012d700
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1402c9204]
call fcn.1400bc700
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402438c0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x14012d839
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14012d79a
mov dword [rbp + 0x160], 1
jmp 0x14012d7a4
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x14012d834
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x64], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14012d80e
cmp qword [rbp + 0x198], 2
jb 0x14012d80e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14012d80e
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14012d80e
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14012d765
jmp 0x14012d8c6
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x84], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14012d8c6
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x14012d89d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14012d89d
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14012d89d
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14012d839
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400bb5b7
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402291e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140229200
xor al, al
jmp 0x140229281
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140229213
xor al, al
jmp 0x140229281
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14022923d
xor al, al
jmp 0x140229281
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140229251
xor al, al
jmp 0x140229281
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140229263
xor al, al
jmp 0x140229281
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14022927f
xor al, al
jmp 0x140229281
mov al, 1
add rsp, 0x38
ret
Function at 0x1400bc183
Capabilities:
Terminate process

Disassembly:
jmp 0x1400eb890
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ace40]
xor rax, rbp
mov qword [rbp + 0x140], rax
lea rcx, [0x1402c913e]
call fcn.1400bc700
nop
lea rdx, [0x1402ad3e0]
mov ecx, 0x20
call fcn.1400ba62b
test eax, eax
jge 0x1400eb8ef
mov ecx, 3
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov r8d, 0x40
xor edx, edx
lea rcx, [0x1402ad400]
call fcn.1400bb8fa
nop
mov eax, dword [0x1402ad450]
mov dword [0x1402ad400], eax
mov eax, dword [0x1402ad450]
mov dword [0x1402ad404], eax
mov dword [0x1402ad408], 0x15
mov dword [0x1402ad414], 0
mov dword [0x1402ad430], 0x50
mov dword [0x1402ad418], 1
mov dword [0x1402ad42c], 1
mov rax, qword [0x1402ad6a0]
mov qword [0x1402ad420], rax
mov dword [0x1402ad428], 1
mov dword [0x1402ad43c], 0x80000000
mov rax, qword [0x1402ad3e0]
mov rax, qword [rax]
lea rcx, [0x1402ad6a8]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1402ad400]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x20
mov r9, qword [0x1402ad6a0]
mov r8d, 1
xor edx, edx
mov rcx, qword [0x1402ad3e0]
call qword [rax + 0x80]
nop
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x10
mov r9d, 8
mov r8d, 0x418
mov edx, 0x37b8
lea rcx, str.1.89.2_WIP
call fcn.1400bb7f6
nop
xor ecx, ecx
call fcn.1400bc5c0
nop
call fcn.1400bb990
mov qword [rbp + 8], rax
mov rcx, qword [0x1402ad6a0]
call fcn.1400b9eb0
nop
mov rcx, qword [0x1402ad6a8]
call fcn.1400b95f0
nop
xor ecx, ecx
call fcn.1400b9f32
nop
call fcn.1400bc06b
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
xorps xmm0, xmm0
movss dword [rax + 0x14], xmm0
mov rax, qword [rbp + 0x28]
movss xmm0, dword [0x14024372c]
movss dword [rax + 0x20], xmm0
lea rdx, str.C:WindowsFont_segoui.ttf
lea rcx, [rbp + 0x48]
call fcn.1400ba847
nop
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x50]
call fcn.1400bc7c8
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x48]
call fcn.1400b93c5
mov rcx, qword [rbp + 0x138]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
movss xmm2, dword [0x14024384c]
mov rdx, rax
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x50]
call fcn.1400bc971
mov qword [0x1402ad448], rax
mov rax, qword [0x1402ad3e0]
mov rax, qword [rax]
mov rcx, qword [0x1402ad3e0]
call qword [rax + 0x10]
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x14023e8f0]
call fcn.1400bbd82
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.1400ba9f0
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret
Function at 0x1400bc2eb
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14012d5f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1402c9204]
call fcn.1400bc700
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402438c0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14012d670
mov dword [rbp + 0x120], 1
jmp 0x14012d67a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14012d6b4
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
jmp 0x14012d63b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1400bcb06
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400dc630
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x1402ace40]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1402c911c]
call fcn.1400bc700
nop
xor edx, edx
mov ecx, 2
call fcn.1400ba964
mov qword [rbp + 0x158], rax
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.1400bbd23
test eax, eax
je 0x1400dc6f2
mov rdx, qword [rbp + 0x258]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400dc6de
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
mov dword [0x1402ad490], eax
mov eax, dword [rbp + 0x18]
jmp 0x1400dc702
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x158]
call fcn.1400bc755
test eax, eax
jne 0x1400dc6ad
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14023c010]
call fcn.1400bbd82
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400ba9f0
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x1400bcc5f
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400fdc60
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402c910c]
call fcn.1400bc700
nop
movsx eax, byte [rbp + 0xe8]
mov ecx, dword [rbp + 0xe0]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret