joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rbp, r8
mov r14d, edx
mov r15, rcx
mov dword [rsp + 0x34], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x14001798e
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], sil
mov edx, esi
mov eax, 2
cmp r8, 0x7e
cmovae edx, eax
mov ecx, 8
cmp r8, 0x10000
cmovae eax, ecx
add rdx, rax
movzx eax, byte [r15 + 0x5c]
neg al
sbb rcx, rcx
and ecx, 4
add rdx, rcx
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140017c60
or r14b, 0x80
mov rdi, qword [rsp + 0x38]
mov byte [rdi], r14b
movzx edx, byte [r15 + 0x5c]
cmp rbp, 0x7e
jae 0x14001785a
neg dl
sbb al, al
and al, 0x80
or al, bpl
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], sil
je 0x1400178fa
mov dword [rdi + 2], 0x78563412
jmp 0x1400178fa
mov rcx, rbp
shr rcx, 8
cmp rbp, 0x10000
jae 0x140017895
mov eax, 0x7e
mov r8d, 0xfe
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], bpl
cmp byte [r15 + 0x5c], 0
je 0x1400178fa
mov dword [rdi + 4], 0x78563412
jmp 0x1400178fa
mov eax, 0x7f
mov r8d, 0xff
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov rax, rbp
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, rbp
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, rbp
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, rbp
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, rbp
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, rbp
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], bpl
cmp byte [r15 + 0x5c], 0
je 0x1400178fa
mov dword [rdi + 0xa], 0x78563412
mov rdx, qword [r15 + 0x28]
mov r9, qword [rsp + 0x40]
mov r8, rdi
lea rcx, [r15 + 0x20]
call fcn.140017e00
mov rdx, qword [r15 + 0x28]
mov r9, qword [rsp + 0xb0]
mov r8, rbx
lea rcx, [r15 + 0x20]
call fcn.140017e00
cmp byte [r15 + 0x5c], 0
je 0x14001795d
mov rdx, qword [r15 + 0x28]
sub rdx, qword [r15 + 0x20]
sub rdx, rbp
test rbp, rbp
je 0x14001795d
nop
mov rcx, qword [r15 + 0x20]
add rcx, rsi
mov rax, rsi
and eax, 3
movzx eax, byte [rsp + rax + 0x34]
xor byte [rcx + rdx], al
inc rsi
cmp rsi, rbp
jne 0x140017940
mov rdx, qword [rsp + 0x48]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140017986
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400179af
mov rcx, rdi
call fcn.140050f70
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140050f50
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140057640
int3
Function at 0x1400179c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rbp, r8
mov r15, rcx
mov dword [rsp + 0x34], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x140017bbe
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], sil
mov edx, esi
mov eax, 2
cmp r8, 0x7e
cmovae edx, eax
mov ecx, 8
cmp r8, 0x10000
cmovae eax, ecx
add rdx, rax
movzx eax, byte [r15 + 0x5c]
neg al
sbb rcx, rcx
and ecx, 4
add rdx, rcx
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140017c60
mov rdi, qword [rsp + 0x38]
mov byte [rdi], 0x82
movzx edx, byte [r15 + 0x5c]
cmp rbp, 0x7e
jae 0x140017a83
neg dl
sbb al, al
and al, 0x80
or al, bpl
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], sil
je 0x140017b23
mov dword [rdi + 2], 0x78563412
jmp 0x140017b23
mov rcx, rbp
shr rcx, 8
cmp rbp, 0x10000
jae 0x140017abe
mov eax, 0x7e
mov r8d, 0xfe
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], bpl
cmp byte [r15 + 0x5c], 0
je 0x140017b23
mov dword [rdi + 4], 0x78563412
jmp 0x140017b23
mov eax, 0x7f
mov r8d, 0xff
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov rax, rbp
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, rbp
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, rbp
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, rbp
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, rbp
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, rbp
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], bpl
cmp byte [r15 + 0x5c], 0
je 0x140017b23
mov dword [rdi + 0xa], 0x78563412
mov rdx, qword [r15 + 0x28]
mov r9, qword [rsp + 0x40]
mov r8, rdi
lea rcx, [r15 + 0x20]
call fcn.140017e00
mov rdx, qword [r15 + 0x28]
mov r9, qword [rsp + 0xb0]
mov r8, rbx
lea rcx, [r15 + 0x20]
call fcn.140017e00
cmp byte [r15 + 0x5c], 0
je 0x140017b8d
mov rdx, qword [r15 + 0x28]
sub rdx, qword [r15 + 0x20]
sub rdx, rbp
test rbp, rbp
je 0x140017b8d
nop word [rax + rax]
mov rcx, qword [r15 + 0x20]
add rcx, rsi
mov rax, rsi
and eax, 3
movzx eax, byte [rsp + rax + 0x34]
xor byte [rcx + rdx], al
inc rsi
cmp rsi, rbp
jne 0x140017b70
mov rdx, qword [rsp + 0x48]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140017bb6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017bdf
mov rcx, rdi
call fcn.140050f70
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140050f50
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140057640
int3
Function at 0x14001bf50
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rsp + 0x58]
shr r8, 0x14
lea r9, [rsp + 0xa5]
movabs r10, 0xcccccccccccccccd
nop word [rax + rax]
dec r9
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x14001bfb0
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], select
mov byte [rsp + 0x20], dil
lea rax, [rsp + 0xa5]
cmp r9, rax
je 0x14001c01a
lea r8, [rsp + 0xa5]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400022d0
nop
mov r8d, 2
lea rdx, [0x14009a5e4]
lea rcx, [rsp + 0x20]
call fcn.140002430
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], select
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001c092
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c08d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c0b6
call fcn.140050f70
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140050f50
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
call fcn.140057640
int3

Function at 0x14001c2b0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x6d]
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ecx
mov r8d, edx
shr r8d, 3
movzx eax, r8b
shl al, 2
lea edx, [rax + r8]
add dl, dl
sub cl, dl
add cl, 0x30
mov byte [r9], cl
mov ecx, r8d
test r8d, r8d
jne 0x14001c2f0
xor eax, eax
mov qword [rbx + 0x18], select
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov byte [rbx], al
lea rax, [rsp + 0x6d]
cmp r9, rax
je 0x14001c34e
lea r8, [rsp + 0x6d]
mov rdx, r9
sub r8, r9
mov rcx, rbx
call fcn.1400022d0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140050f50
add rsp, 0x80
pop rbx
ret
Function at 0x140047fa8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140032e3a
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140032e1d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140032e08

Function at 0x1400579c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140057853
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140057853
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140057853
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140057853
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140057853
cmp dword [rcx + 0x84], 0xe
jbe 0x140057853
cmp dword [rcx + 0xf8], 0
je 0x140057853
mov ecx, ebx
call fcn.1400578f4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400576e4
cmp dword [rbp + 0x20], 0
je 0x1400578a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400578a8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400577ec
Function at 0x140015470
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14004d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14007ee60]
mov edi, ecx
cmp byte [rbx + 0x4a4d], 0
jne 0x1400154d1
cmp byte [rbx + 0x4a4e], 0
jne 0x1400154d1
movsx r9d, word [rbx + 0x5b4a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400053e0
test dil, 1
je 0x1400155f8
jmp 0x14001555c
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b4a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140046768]
mov edx, 0x10
mulss xmm1, dword [0x140046748]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47b0], rax
mov dword [rbx + 0x479c], 1
movss dword [rbx + 0x47a8], xmm0
movss dword [rbx + 0x47ac], xmm1
movss xmm0, dword [rbx + 0x3914]
mulss xmm0, dword [0x1400466d4]
or dword [rbx + 0x4798], 0x41
movss dword [rbx + 0x47f8], xmm0
call fcn.1400053e0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400155b0
lea r11, [0x140041720]
nop dword [rax]
cmp r9b, 0x23
jne 0x140015593
cmp byte [r8], r9b
jne 0x140015593
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140015580
not ecx
call fcn.14000c620
test rax, rax
je 0x1400155f8
cmp byte [rax + 0xae], 0
je 0x1400155f8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b4a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b4a]
call fcn.1400053e0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000ed60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003d7f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140039f10
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140039f41
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14007f018]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14007f028]
lea rdx, [rdi + rdi]
call fcn.140039ad0
mov rax, qword [0x14007f018]
lea r9, [rdi - 1]
mov qword [0x14007f040], r9
mov qword [0x14007f048], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14003a0b4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14007f028]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003a000
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14003a075
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14003a03d
mov r10, qword [rdx]
cmp r10, rax
je 0x14003a037
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003a075
cmp r9, rdx
je 0x14003a051
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14003a089
cmp r9, rdx
jne 0x14003a042
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14003a0af
mov r9, qword [0x14007f040]
jmp 0x140039fb1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003a075
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003e5c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e60a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e60a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e60a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e60a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e60a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003e60c
xor al, al
add rsp, 0x28
ret
Function at 0x1400042bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004306
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004306
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004306
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004306
cmp dword [rcx + 0x84], 0xe
jbe 0x140004306
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004308
xor al, al
add rsp, 0x28
ret

Function at 0x140009fa4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000a013
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a013
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a013
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a013
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a013
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a013
cmp dword [rcx + 0xf8], 0
je 0x14000a013
mov ecx, ebx
call fcn.14000a0c4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140009ea0
nop
cmp dword [rbp + 0x20], 0
je 0x14000a061
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000a06c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140009fa4

Function at 0x14000a1a8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009fa4
Function at 0x14000c8bc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000c943
mov rsi, rbx
cmp word [rax], bp
je 0x14000c902
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000c8ec
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000c8e8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000b29c
mov rdi, rax
test rax, rax
je 0x14000c930
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140011b50
mov rbp, rdi
xor ecx, ecx
call fcn.14000b584
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011433
Capabilities:
Terminate process

Disassembly:
jmp 0x14001c030
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001155f
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001d380
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001d3a0
xor al, al
jmp 0x14001d421
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001d3b3
xor al, al
jmp 0x14001d421
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001d3dd
xor al, al
jmp 0x14001d421
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001d3f1
xor al, al
jmp 0x14001d421
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001d403
xor al, al
jmp 0x14001d421
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001d41f
xor al, al
jmp 0x14001d421
mov al, 1
add rsp, 0x38
ret
Function at 0x140016c10
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x14002a040]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1400300f6]
call fcn.14001178f
nop
mov dword [rbp + 4], 0
mov edx, dword [rbp + 0x700]
mov ecx, 0x18
call fcn.140011393
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x140016cc8
mov dword [rbp + 0x50], 0x438
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400114d8
test eax, eax
je 0x140016cc8
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140016cb7
mov eax, dword [rbp + 0x68]
mov dword [rbp + 4], eax
jmp 0x140016cc8
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400110ff
test eax, eax
jne 0x140016c97
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400240e0]
call fcn.14001165e
mov eax, edi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400113b1
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret

Function at 0x14001b240
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400117e9
movzx eax, al
test eax, eax
jne 0x14001b260
mov ecx, 7
call fcn.140011668
nop
mov byte [rsp + 0x20], 0
call fcn.1400116a4
mov byte [rsp + 0x21], al
cmp dword [0x14002ab88], 1
jne 0x14001b284
mov ecx, 7
call fcn.140011668
nop
jmp 0x14001b2dc
cmp dword [0x14002ab88], 0
jne 0x14001b2d7
mov dword [0x14002ab88], 1
lea rdx, [0x140023660]
lea rcx, [0x140023330]
call fcn.14001138e
test eax, eax
je 0x14001b2b8
mov eax, 0xff
jmp 0x14001b3e1
lea rdx, [0x140023220]
lea rcx, [section..rdata]
call fcn.14001168b
mov dword [0x14002ab88], 2
jmp 0x14001b2dc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001164f
call fcn.140011591
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001b339
mov rcx, qword [rsp + 0x30]
call fcn.1400112df
movzx eax, al
test eax, eax
je 0x14001b339
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140031020]
nop
call fcn.1400115e6
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001b36d
mov rcx, qword [rsp + 0x38]
call fcn.1400112df
movzx eax, al
test eax, eax
je 0x14001b36d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011767
nop
call fcn.14001b490
mov dword [rsp + 0x28], eax
call fcn.14001155f
movzx eax, al
test eax, eax
jne 0x14001b38c
mov ecx, dword [rsp + 0x28]
call fcn.140011096
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001b39b
call fcn.14001177b
nop
xor edx, edx
mov cl, 1
call fcn.1400112ad
mov eax, dword [rsp + 0x28]
jmp 0x14001b3e1
add rsp, 0x68
ret
Function at 0x6b8000
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6b800d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x6b801d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6b8005
lea eax, [rcx + 1]
jmp 0x6b802b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x6b803e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x6b8024
sub eax, 3
jb 0x6b805e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x6b80ad
sar eax, 1
movsxd rbp, eax
jb 0x6b8094
jmp 0x6b806c
add ebx, ebx
jne 0x6b806a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6b8094
inc ecx
add ebx, ebx
jne 0x6b807a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6b8094
call r11
adc ecx, ecx
add ebx, ebx
jne 0x6b808d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x6b807c
add ecx, 2
jmp 0x6b8099
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.006b7fc2
jmp 0x6b800d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x9e800
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x6b80f9
cmp rsi, rcx
jae 0x6b8101
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x6b80e0
cmp al, 0x8f
ja 0x6b80e0
cmp byte [rsi - 2], 0xf
je 0x6b80e6
sub al, 0xe8
cmp al, 1
ja 0x6b80ca
cmp rsi, rcx
jae 0x6b8101
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x6b80d0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x6b8101
lodsb al, byte [rsi]
jmp 0x6b80e0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2b4000]
mov eax, dword [rdi]
or eax, eax
je 0x6b815e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2b8000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x6b810e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x6b8158
mov qword [rbx], rax
add rbx, 8
jmp 0x6b812e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x6b8198
cmp al, 0xef
ja 0x6b818a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x6b816a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x6b8179
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x6b81ec
sub rsp, 0xffffffffffffff80
jmp 0x464900