joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003560
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
mov r8, rcx
xor edi, edi
xor ecx, ecx
xor eax, eax
xchg rbx, r9
cpuid
xchg rbx, r9
test eax, eax
jle 0x140003681
mov r10d, eax
xor ecx, ecx
mov eax, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov r9d, ecx
mov r11d, edx
mov esi, eax
cmp r10d, 7
jb 0x1400036c1
mov eax, 7
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r10d, ecx
and edi, 0x20
shr edi, 5
shr r10b, 4
and r10b, 1
mov dword [r8], esi
mov eax, esi
and eax, 0xf
mov dword [r8 + 8], eax
shr esi, 0xc
and esi, 3
mov dword [r8 + 4], esi
mov eax, r11d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r11d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r11d, 0x1a
and r11b, 1
mov byte [r8 + 0xe], r11b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x1a], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x1400036b7
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
and al, dil
mov byte [r8 + 0x16], al
mov byte [r8 + 0x18], r10b
xor ecx, ecx
mov eax, 0x80000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp eax, 0x80000006
jle 0x1400036bb
xor ecx, ecx
mov eax, 0x80000007
xchg rbx, r9
cpuid
xchg rbx, r9
shr edx, 8
and dl, 1
mov byte [r8 + 0x19], dl
test dl, dl
je 0x1400036c9
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140003654
mov dl, byte [r8 + 0x19]
jmp 0x1400036b0
xor r10d, r10d
jmp 0x1400035bf
cmp byte [r8 + 0x1a], 0
je 0x1400036b4
xor ecx, ecx
mov eax, 0x40000000
xchg rbx, r9
cpuid
xchg rbx, r9
cmp r9d, 0x7263694d
jne 0x1400036b4
cmp ecx, 0x666f736f
jne 0x1400036b4
cmp edx, 0x76482074
jne 0x1400036b4
mov byte [r8 + 0x19], 1
jmp 0x1400036b4

Function at 0x140003830
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140092598]
test rax, rax
jne 0x140003889
cmp byte [0x1400925a0], 0
jne 0x1400038a3
mov byte [0x1400925a0], 1
lea rcx, str.bcryptprimitives.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400038d5
lea rdx, str.ProcessPrng
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140092598], rax
test rax, rax
je 0x1400038a3
mov rcx, rdi
mov rdx, rsi
call qword [0x14009f008]
test eax, eax
je 0x1400038d2
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
test rsi, rsi
je 0x140003899
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400038d8
add rdi, rbx
sub rsi, rbx
jne 0x1400038ae
jmp 0x140003899
int3
int3
int3
Function at 0x140004a20
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140083028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140004c5c
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14008fe50], rax
jne 0x140004c5f
mov rsi, rcx
mov r14d, dword [rcx + 8]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
cmp byte [rcx + 2], 0
sete al
bsr rdx, r14
xor rdx, 0xffffffffffffffc0
lea rcx, [0x1400739f0]
mov cl, byte [rdx + rcx + 0x41]
mov r8, r14
shr r8, cl
and r8d, 7
lea rcx, [0x140073a40]
mov rcx, qword [rcx + rdx*8 + 0x208]
and rcx, r14
lea rdx, [r8 + rdx*8]
add rdx, 0x208
cmp rcx, 1
sbb rdx, 0xffffffffffffffff
lea rcx, [0x1400731d0]
movzx ecx, word [rcx + rdx*2 + 0x400]
cmp cx, 0x6e
setb dl
and dl, al
movzx eax, dl
or eax, ecx
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rdi, [rsi + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140004b46
mov rax, qword [r15]
mov rbx, qword [rax]
test rbx, rbx
je 0x140004b50
mov byte [rsp + 0x3f], 0
mov r8, qword [rbx]
test r8, r8
je 0x140004bb7
lea rdx, [rsi + 0x48]
mov rcx, r8
bswap rcx
mov r14d, dword [rdx + r12*8 + 0x18]
mov rdx, rcx
xor rdx, rbx
cmp rdx, 0x1fffff
ja 0x140004c62
mov edx, ecx
and edx, 0x1fc000
je 0x140004c62
prefetcht0 byte [rcx]
jmp 0x140004bb9
mov rcx, rdi
call fcn.14000e560
jmp 0x140004af5
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14000c820
test rax, rax
je 0x140004c58
mov rbx, rax
and rax, 0xffffffffffe00000
mov ecx, ebx
shr ecx, 0xe
movzx ecx, cl
shl rcx, 5
or rcx, rax
mov rax, rcx
or rax, 0x1000
or rcx, 0x101e
movzx ecx, byte [rcx]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
jmp 0x140004bd3
xor ecx, ecx
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rbx
mov rdx, rsi
call fcn.14000ea80
mov ecx, dword [0x1400932b0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140091100]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001a010
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140004bfd
int3
int3
movaps xmm0, xmmword [0x140072cb0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
lea rdx, str.first
mov rcx, rsi
call fcn.140045a60
mov rcx, rsi
call fcn.140001270
mov rcx, r14
call fcn.140045ac0
int3
Function at 0x140004d50
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x140094d88], 0
jne 0x140004d8d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140004d80
mov dword [rdi], eax
mov dword [0x140094d90], eax
mov qword [0x140094d88], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3
Function at 0x140019a1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019a66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019a66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019a66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019a66
cmp dword [rcx + 0x84], 0xe
jbe 0x140019a66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019a68
xor al, al
add rsp, 0x28
ret

Function at 0x14001a5e4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14001a65c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14001a65c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14001a65c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14001a650
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14001a66e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14001a63e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14001a65e

Function at 0x140024c48
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140024c7f
call fcn.140027a48
mov dword [rax], 0x16
call fcn.1400353d4
xor eax, eax
jmp 0x140024d0d
mov rdx, r9
mov rcx, r8
call fcn.140024d30
mov rbx, rax
test rax, rax
je 0x140024d0a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140024da0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140024cf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140027a88
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140024cde
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140024ced
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14000f4c0
jmp 0x140024d0a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140024d07
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140024e74
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140024fbc
Function at 0x14002f490
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002f4b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002f4b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140039608
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140033034
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400396a9
cmp ebx, dword [rsp + 0x30]
je 0x1400396a2
test esi, esi
je 0x1400396a2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14003967d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14003968a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140039667
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14003968e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400396ab
mov eax, 1
jmp 0x1400396ab
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a578
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003a5ff
mov rsi, rbx
cmp word [rax], bp
je 0x14003a5be
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003a5a8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003a5a4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000f5d0
mov rdi, rax
test rax, rax
je 0x14003a5ec
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001c0e0
mov rbp, rdi
xor ecx, ecx
call fcn.14000f4c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d294
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003d2aa
mov al, 1
jmp 0x14003d30a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003d2bb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003d308
mov ecx, dword [rcx + 0x18]
nop
call fcn.140027b9c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003d308
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003d308
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003d308
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003d30a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400443a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1400443b3
cmp dword [0x140092580], ecx
jle 0x1400443ba
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.140044400
test edi, edi
je 0x1400443b3
cmp byte [rsi + rdi - 1], 0xa
je 0x1400443b3
lea rcx, [0x140072c91]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140044400

Function at 0x140044400
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140083028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14004444e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x14004448c
cmp rdi, rsi
jae 0x14004448c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140044447
jmp 0x140044444
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001a010
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400550b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14011bc78]
test rax, rax
je 0x1400550cf
call rax
mov al, 1
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x60], rbx
mov cl, 0x69
xor ebx, ebx
mov qword [rsp + 0x68], rdi
mov dword [rbp - 0x30], 0x91e82f69
mov r9d, ebx
mov dword [rbp - 0x2c], 0xce69932e
movabs rdi, 0x8080808080808081
mov dword [rbp - 0x28], 0xed2425
lea r10d, [rbx + 0xa]
nop dword [rax]
nop word [rax + rax]
movsx eax, cl
inc eax
movsxd r8, eax
lea rax, [r9 + 0xa]
imul r8, rax
mov rax, rdi
mul r8
shr rdx, 7
imul rax, rdx, 0xff
movsx rdx, cl
sub r8, rax
movzx eax, r9b
and al, 7
shl al, 3
movzx ecx, al
mov rax, rdi
sar rdx, cl
mov rcx, r10
xor r8b, dl
mul r10
add r10, 0xa
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
xor r8b, cl
xor byte [rbp + r9 - 0x2f], r8b
inc r9
cmp r10, 0x6e
jae 0x14005517c
movzx ecx, byte [rbp - 0x30]
jmp 0x140055110
lea rcx, [rbp - 0x2f]
mov byte [rbp - 0x25], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
je 0x14005525b
movdqa xmm0, xmmword [0x14010ab20]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x792291b0
mov word [rbp - 0xc], 0xf011
lea r9d, [rax + 0x15]
mov byte [rbp - 0xa], al
nop dword [rax + rax]
movsx rcx, byte [rbp - 0x20]
lea eax, [rcx + 1]
movsxd r8, eax
lea rax, [rbx + 0x15]
imul r8, rax
mov rax, rdi
mul r8
shr rdx, 7
imul rax, rdx, 0xff
mov rdx, rcx
sub r8, rax
movzx eax, bl
and al, 7
shl al, 3
movzx ecx, al
mov rax, rdi
sar rdx, cl
mov rcx, r9
xor r8b, dl
mul r9
add r9, 0x15
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
xor r8b, cl
xor byte [rbp + rbx - 0x1f], r8b
inc rbx
cmp r9, 0x1ce
jb 0x1400551c0
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0xa], 0
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011bc78], rax
test rax, rax
je 0x14005525b
call rax
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
mov rbx, qword [rsp + 0x60]
xor al, al
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140055360
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xf0
mov rax, qword [0x140114700]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x24], eax
xor ebx, ebx
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [r11 - 0x64], xmm0
mov dword [rsp + 0x20], ebx
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140055466
mov qword [rsp + 0x108], rsi
mov esi, dword [rsp + 0x60]
mov qword [rsp + 0x110], rdi
nop dword [rax + rax]
mov rdx, rsi
lea rcx, [0x140055270]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [0x14011bc68], 0
jne 0x14005543e
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3a98
jl 0x140055410
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x110]
mov eax, esi
mov rsi, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400ba4d0
add rsp, 0xf0
pop rbx
ret
Function at 0x14005bc90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14005bcf1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14005bcb0
mov ecx, dword [r9]
jmp 0x14005bddb
cmp ecx, 0x4e0
jb 0x14005bddb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14005bd10
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14005bd60
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14005bf60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x14005bf70
mov dword [rcx], 0x270
ret
Function at 0x140065cb0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140065d92
call fcn.14007c900
test al, al
jne 0x140065d92
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140065ce2
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rbx
call fcn.140087940
test rax, rax
je 0x140065d27
sub rax, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov r8, rax
mov rcx, rbx
call fcn.140087940
mov rsi, rax
test rax, rax
je 0x140065d27
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x140065d5b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140077f00
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140065d40
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140075d00
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x140114700]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x140075d66
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140075d49
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140075d43
shr ax, 8
cmp al, 2
je 0x140075d66
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400ba4d0
add rsp, 0x1e8
ret
call fcn.1400abca0
test eax, eax
jne 0x140075f65
mov qword [rsp + 0x200], rsi
lea rcx, [0x1400ecd60]
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140075da6
mov qword [0x14011a968], rsi
jmp 0x140075f22
mov qword [rsp + 0x1f0], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x1400ecd80]
call fcn.1400c7c90
test rax, rax
je 0x140075e0a
mov rcx, rbx
test rbp, rbp
je 0x140075dfc
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x140075eea
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x140075eea
test rbp, rbp
je 0x140075e39
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140075e39
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x140075eea
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x140075ee2
lea ecx, [rax + 1]
add rcx, 0xc
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140075ed9
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140075ed9
mov rcx, 0xffffffffffffffff
mov rax, rcx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x140075e85
mov word [rax + rdi], 0x5c
inc rcx
cmp byte [rdi + rcx], sil
jne 0x140075e96
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140075eb0
mov rcx, rdi
test rbp, rbp
je 0x140075ed0
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x140075ed6
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1400c492c]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x14011a968], rsi
test rsi, rsi
je 0x140075f22
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140075f22
mov qword [0x14011a960], rax
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1400ab850
test al, al
lea rcx, [0x14011bc90]
setne byte [0x14011bc88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400ba4d0
add rsp, 0x1e8
ret