joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b780
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.1400bf5d0
sub rsp, rax
mov rax, qword [0x1400f2040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x14009b802
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.14009e090
test al, al
jne 0x14009b80a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.140021b50
lea rdx, [0x140021d30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x14009b8f2
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x14009b831
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14009b8ac
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009b8a5
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x14009b893
cmp rdi, rax
je 0x14009b92c
inc esi
cmp esi, r15d
jb 0x14009b870
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.140021b50
lea rdx, [0x140021d30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.14009bb30
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140025bf0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14009b8ac
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14009b8ac
test ecx, ecx
je 0x14009b8ac
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x14009b8d2
Function at 0x14009f5e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14009f6c6
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14009f6c6
mov r8d, dword [rax + rcx + 0xd8]
mov qword [rsp + 0x20], rdi
test r8d, r8d
je 0x14009f6ba
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
je 0x14009f6ba
sub rcx, rdx
mov qword [rsp + 0x38], rsi
add rdi, rcx
movabs rsi, 0x2b992ddfa232
cmp qword [rdi], rsi
je 0x14009f675
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
call fcn.140021b50
lea rdx, [0x140021d30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, qword [rsp + 0x38]
xor al, al
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
mov rsi, qword [rsp + 0x38]
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400be150
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400f2040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400be262
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400be262
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x1400be1c9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x1400be26d
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x1400be250
mov edx, dword [rbx + 4]
test edx, edx
je 0x1400be250
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x1400be229
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x1400be245
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140024c60
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x1400be1e1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x1400be26d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140025bf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400bf040
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1400f2040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400bf0ce
test rbx, rbx
je 0x1400bf096
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400bf080
test eax, eax
jns 0x1400bf0ef
test rbx, rbx
je 0x1400bf0f4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400bf1f2
test rbx, rbx
jne 0x1400bf0fb
xor eax, eax
jmp 0x1400bf1f2
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x1400bf1d2
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400bf150
lea rcx, [rsp + 0x28]
call fcn.14000ef90
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400bf170
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400bf208
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400bf1c8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bf1c3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bf251
call fcn.140025c10
inc edi
cmp edi, dword [rbx]
jb 0x1400bf114
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140025bf0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400bf25d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bf258
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400bf258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140025c10
mov rax, rdi
jmp 0x1400bf1e5
Function at 0x140007020
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140007043
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140007043
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140007044
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000707e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140007075
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140007080
inc r8d
add rax, 0x28
jmp 0x14000705c
xor eax, eax
ret

Function at 0x1400070f1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140023160]
mov r8, rcx
mov rcx, r9
call fcn.140007020
test eax, eax
je 0x14000711d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140007044
xor eax, eax
add rsp, 0x28
ret
Function at 0x140011940
Capabilities:
Get storage device properties

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rcx, [0x14001f260]
call fcn.14000788f
lea rcx, [0x14001f660]
mov rbx, rax
call fcn.14000788f
cmp byte [rbx], 0
mov rcx, rax
lea r10, [rax + 0xa]
jne 0x14001199a
mov qword [rax], 0
mov dword [rax + 8], 0
movabs rax, 0xf41a100f190f1430
mov qword [rcx + 0xa], rax
movabs rax, 0x86eee7e6eac2f41a
mov qword [r10 + 6], rax
mov byte [rbx], 1
cmp byte [rcx + 9], 0
jne 0x140011a20
mov ebx, 0x79
lea r11, [rcx + 0x18]
mov r8, r10
sub ebx, r10d
nop dword [rax + rax]
mov eax, dword [rcx]
jmp 0x1400119f0
lea r9d, [rdx + 2]
cmp r9d, eax
je 0x140011a08
cmp edx, eax
je 0x140011a10
lea r9d, [rdx + 4]
cmp r9d, eax
je 0x140011b00
lea r9d, [rdx + 5]
cmp r9d, eax
jne 0x140011a17
add edx, 4
xor byte [r8], dl
mov eax, dword [rcx]
add eax, 1
mov dword [rcx], eax
mov edx, dword [rcx + 4]
lea r9d, [rdx + 1]
cmp r9d, eax
jne 0x1400119c0
add edx, 1
xor byte [r8], dl
jmp 0x1400119e9
add edx, 2
xor byte [r8], dl
jmp 0x1400119e9
lea eax, [rbx + r8]
xor byte [r8], al
add r8, 1
cmp r11, r8
jne 0x1400119b8
mov byte [rcx + 9], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
mov rcx, r10
call qword [0x14002c890]
mov rbx, rax
test rax, rax
je 0x140011ba0
lea rcx, [0x14001f240]
call fcn.14000788f
lea rcx, [0x14001f640]
mov rsi, rax
call fcn.14000788f
cmp byte [rsi], 0
mov rcx, rax
lea r10, [rax + 0xa]
jne 0x140011aa5
mov qword [rax], 0
movabs rdx, 0xeba9e3e9e3ecede6
mov dword [rax + 8], 0
movabs rax, 0xaf50440e0c0f0e11
mov qword [rcx + 0xa], rax
mov qword [rcx + 0x12], rdx
mov dword [r10 + 0xf], 0x8be7e6eb
mov byte [rsi], 1
cmp byte [rcx + 9], 0
je 0x140011b0b
mov byte [rcx + 9], 1
xor r9d, r9d
mov rcx, rbx
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov rdx, r10
mov dword [rsp + 0x20], 0x80000000
call qword [0x14002c898]
mov rcx, rax
test rax, rax
je 0x140011baa
mov rsi, qword [0x14002c888]
call rsi
mov rcx, rbx
call rsi
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
add edx, 3
xor byte [r8], dl
jmp 0x1400119e9
mov esi, 0x79
lea r11, [rcx + 0x1d]
mov r8, r10
sub esi, r10d
nop word [rax + rax]
mov eax, dword [rcx]
jmp 0x140011b54
lea r9d, [rdx + 2]
cmp r9d, eax
je 0x140011b70
cmp edx, eax
je 0x140011b80
lea r9d, [rdx + 4]
cmp r9d, eax
je 0x140011b98
lea r9d, [rdx + 5]
cmp r9d, eax
jne 0x140011b87
add edx, 4
xor byte [r8], dl
mov eax, dword [rcx]
add eax, 1
mov dword [rcx], eax
mov edx, dword [rcx + 4]
lea r9d, [rdx + 1]
cmp r9d, eax
jne 0x140011b28
add edx, 1
xor byte [r8], dl
jmp 0x140011b4d
add edx, 2
xor byte [r8], dl
jmp 0x140011b4d
lea eax, [rsi + r8]
xor byte [r8], al
add r8, 1
cmp r11, r8
jne 0x140011b20
jmp 0x140011aab
add edx, 3
xor byte [r8], dl
jmp 0x140011b4d
mov ecx, 1
call fcn.14000b360
mov rcx, rbx
call qword [0x14002c888]
mov ecx, 1
call fcn.14000b360
nop
nop
nop
Function at 0x140011bc0
Capabilities:
Get storage device properties

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x480
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [0x14002c4c0]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011d76
lea rsi, [rsp + 0x80]
xor eax, eax
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x54], 0
mov rdi, rsi
lea r8, [rsp + 0x54]
mov edx, 0x2d1400
mov dword [rsp + 0x5c], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x44]
mov rcx, rbx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x38], 0
mov r9d, 0xc
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rsi
call qword [0x14002c4e8]
mov rcx, rbx
test eax, eax
je 0x140011d70
mov rdi, qword [0x14002c4b0]
lea rbp, [rsp + 0x70]
lea r12, [rsp + 0x60]
call rdi
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x60], rbp
add rsi, rax
mov rcx, rsi
call fcn.14000b3f0
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, 0xf
ja 0x140011da0
cmp rax, 1
jne 0x140011d90
movzx edx, byte [rsi]
mov byte [rsp + 0x70], dl
mov rdx, rbp
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov r9d, 0xd
mov rcx, r12
mov byte [rdx + rax], 0
lea rdx, str.DADY_HARDDISK
call fcn.1400179f0
cmp rax, 0xffffffffffffffff
jne 0x140011d14
mov r9d, 0xd
xor r8d, r8d
mov rcx, r12
xor ebx, ebx
lea rdx, str.QEMU_HARDDISK
call fcn.1400179f0
cmp rax, 0xffffffffffffffff
je 0x140011d47
call qword [0x14002c520]
xor edx, edx
mov ecx, 1
mov r8d, eax
call qword [0x14002c5c8]
mov rbx, rax
test rax, rax
je 0x140011d42
mov rcx, rax
xor edx, edx
call qword [0x14002c670]
mov rcx, rbx
call rdi
mov ebx, 1
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x140011d78
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.14001d1f0
mov eax, ebx
add rsp, 0x480
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [0x14002c4b0]
xor ebx, ebx
mov eax, ebx
add rsp, 0x480
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rax, rax
jne 0x140011ddc
mov rdx, rbp
jmp 0x140011ccd
mov rcx, r12
lea rdx, [rsp + 0x48]
xor r8d, r8d
call fcn.14001c4b0
mov qword [rsp + 0x60], rax
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rdx, rsi
mov r8, rbx
call fcn.14000b3b0
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
jmp 0x140011ccd
mov rcx, rbp
jmp 0x140011dc2
Function at 0x1400088cc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400088f9
xor eax, eax
jmp 0x140008948
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
xor ebx, ebx
jmp 0x140008932
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.14007b9fc
test eax, eax
je 0x140008938
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140008913
jmp 0x14000893d
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140008960
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140008992
xor eax, eax
jmp 0x140008a10
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
xor edi, edi
jmp 0x1400089cb
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call fcn.14007b9fc
test eax, eax
je 0x1400089d1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400089ac
jmp 0x140008a05
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140008a05
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
setne dil
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140009014
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140009042
xor eax, eax
jmp 0x140009128
cmp qword [rcx + 0x68], 0
je 0x140009053
call fcn.14000981c
jmp 0x140009128
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000906a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000906c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000909e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400a1c10
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140009122
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400090d5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400090fe
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14007bef0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140009122
cmp rsi, rbx
ja 0x1400090dc
test rsi, rsi
je 0x140009122
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14007bef0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000e5c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400d1840]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x1400d3190]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000e608
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x14000e5fc
mov rax, qword [rax + 0x10]
jmp 0x14000e602
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000e5f0
cmp byte [rcx + 0x19], 0
jne 0x14000e6e4
cmp dword [rcx + 0x20], 4
jg 0x14000e6e4
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14000e631
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x14000e663
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x14000e650
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000df80
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14000e69e
cmp rcx, qword [rbx + 8]
je 0x14000e69e
cmp qword [rbx + 0x10], 1
jne 0x14000e6a2
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400716e0
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x14000e688
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14000e710
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.14000b080
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000e560
lea rdx, [0x1400ceca8]
lea rcx, [rsp + 0x20]
call fcn.140073078
nop
lea rcx, str.invalid_map_K__T__key
call fcn.14006fb7c
int3
Function at 0x1400195c0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x14001969b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.14001d1e0
cmp eax, 4
je 0x140019618
mov edx, eax
jmp 0x140019645
cmp byte [0x1400d3474], r14b
jne 0x14001964f
mov r9d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 2]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x14001969d
mov eax, dword [rsp + 0x50]
jmp 0x14001966e
imul eax, dword [0x1400d3470], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1400d3470], eax
ror eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140019692
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x140019680
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x1400195f0
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400196b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x140019753
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001d1e0
cmp eax, 4
jne 0x14001971f
cmp byte [0x1400d3474], bpl
jne 0x14001976b
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x140019758
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x1400196e0
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x1400196e0
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x1400d3470], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1400d3470], ecx
ror ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x140019727
Function at 0x14001f7b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001f892
call fcn.140035ce0
test al, al
jne 0x14001f892
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x14001f7e2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140037030
test rax, rax
je 0x14001f827
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140037030
mov rsi, rax
test rax, rax
je 0x14001f827
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x14001f85b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140019090
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x14001f840
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret