joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058c90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140058e6f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140058b50
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140058e34
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140058dac
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140058e23
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140058de9
mov r10, qword [rdx]
cmp r10, rax
je 0x140058de3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140058e23
cmp r9, rdx
je 0x140058dff
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140058e49
cmp r9, rdx
jne 0x140058df0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140058d30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140058e23
lea rcx, str.invalid_hash_bucket_count
call fcn.140074050
int3
Function at 0x140059aa0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14014ba40]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx ebp, dl
mov rsi, rcx
lea rdx, [rcx + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140004a80
nop
xor ebx, ebx
xor r14d, r14d
mov rdi, qword [rsi + 0x38]
sub rdi, qword [rsi + 0x30]
je 0x140059b50
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140059d24
cmp rdi, 0x1000
jb 0x140059b2e
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140059d2a
call fcn.140038844
test rax, rax
je 0x140059d1e
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140059b39
mov rcx, rdi
call fcn.140038844
mov rbx, rax
lea r14, [rbx + rdi]
mov r8, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x30]
sub r8, rdx
mov rcx, rbx
call fcn.140083920
mov rax, qword [rsi + 0x38]
sub rax, qword [rsi + 0x30]
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x28]
cmp rax, 1
jne 0x140059b6d
cmp byte [rbx], 0xcc
jmp 0x140059b7c
cmp rax, 2
jb 0x140059b82
cmp byte [rbx], 0xf3
jne 0x140059b82
cmp byte [rbx + 1], 0xc3
je 0x140059d16
lea rcx, [rsp + 0x28]
cmp r15, 0x10
cmovae rcx, rsi
mov rdi, qword [rsp + 0x38]
cmp rdi, 3
jne 0x140059bb6
mov r8, rdi
lea rdx, [0x1400a96b0]
call fcn.140084360
test eax, eax
jne 0x140059bb6
test bpl, bpl
je 0x140059d16
lea rcx, [rsp + 0x28]
cmp r15, 0x10
cmovae rcx, rsi
cmp rdi, 3
jne 0x140059be0
mov r8, rdi
lea rdx, [0x1400aa1e8]
call fcn.140084360
test eax, eax
je 0x140059d16
lea rbp, [rsp + 0x28]
cmp r15, 0x10
cmovae rbp, rsi
cmp rdi, 4
jb 0x140059c78
lea r8, [rdi - 3]
add r8, rbp
sub r8, rbp
mov edx, 0x69
mov rcx, rbp
call fcn.140084440
mov r9, rax
test rax, rax
je 0x140059c78
lea r12, str.iret
nop dword [rax]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x140059c49
cmp rcx, 4
jne 0x140059c30
xor eax, eax
jmp 0x140059c4e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140059d0d
inc r9
lea r8, [rdi - 3]
add r8, rbp
sub r8, r9
mov edx, 0x69
mov rcx, r9
call fcn.140084440
mov r9, rax
test rax, rax
jne 0x140059c20
xor dil, dil
test rbx, rbx
je 0x140059cb0
sub r14, rbx
cmp r14, 0x1000
jb 0x140059ca4
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140059d1e
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.140038810
nop
cmp r15, 0x10
jb 0x140059ce3
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140059cdb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059d30
mov rcx, rsi
call fcn.140038810
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400385b0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r9, rbp
jne 0x140059c78
mov dil, 1
jmp 0x140059c7b
call fcn.140020358
int3
call fcn.140009130
int3
call fcn.140002970
nop
call fcn.140020358
int3
Function at 0x14005a050
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
movzx r9d, dl
movabs r14, 0xcbf29ce484222325
xor r9, r14
movabs rsi, 0x100000001b3
imul r9, rsi
movzx eax, byte [rbp + 0x29]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2a]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2b]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2c]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2d]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2e]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2f]
xor r9, rax
imul r9, rsi
mov rcx, qword [rcx + 0x50]
and rcx, r9
shl rcx, 4
add rcx, qword [rbx + 0x38]
mov rax, qword [rcx + 8]
mov r9, qword [rbx + 0x28]
cmp rax, r9
je 0x14005a111
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14005a113
nop
cmp rax, rcx
je 0x14005a111
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14005a100
jmp 0x14005a113
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14005a166
lea rbx, [rax + 0x18]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x14005a142
mov rdx, r8
mov rcx, rax
call fcn.14004e8e0
add qword [rbx + 8], 0xa8
jmp 0x14005a14d
mov rdx, rax
mov rcx, rbx
call fcn.14004b6e0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14004b6e0
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x30]
lea rcx, [rbx + 0x20]
call fcn.140058000
mov r8, qword [rbp + 0x28]
movzx edx, r8b
xor rdx, r14
imul rdx, rsi
movzx eax, byte [rbp + 0x29]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2a]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2b]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2c]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2d]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2e]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2f]
xor rdx, rax
imul rdx, rsi
mov rcx, qword [rbx + 0x50]
and rcx, rdx
shl rcx, 4
add rcx, qword [rbx + 0x38]
mov rax, qword [rcx + 8]
cmp rax, qword [rbx + 0x28]
je 0x14005a2c7
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x14005a233
nop dword [rax + rax]
cmp rax, rcx
je 0x14005a2c7
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x14005a220
lea r14, [rax + 0x18]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x14005a2b9
mov rbx, rdi
mov rsi, qword [rbp - 0x18]
cmp rdi, rsi
je 0x14005a264
nop dword [rax]
mov rcx, rbx
call fcn.14004ef00
add rbx, 0xa8
cmp rbx, rsi
jne 0x14005a250
mov rcx, qword [rbp - 0x10]
sub rcx, rdi
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0xa8
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005a2b1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a2c1
mov rcx, rdi
call fcn.140038810
mov rax, r14
jmp 0x14005a150
call fcn.140020358
nop
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.140074074
int3
Function at 0x14005c720
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r9 + 8]
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov r11, qword [rdx + 8]
mov rbx, r11
cmp r11, r8
je 0x14005c7d4
mov rax, qword [r10]
mov rcx, qword [rdx]
cmp rax, qword [r11 + 0x10]
je 0x14005c7d6
cmp rbx, rcx
je 0x14005c7d4
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x14005c7c3
jmp 0x14005c7d6
xor ebx, ebx
test rbx, rbx
je 0x14005c881
mov rax, qword [rdx]
mov qword [rsp + 0x38], rdi
cmp r11, rbx
jne 0x14005c804
cmp rax, rbx
jne 0x14005c7fa
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x14005c80f
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x14005c80f
cmp rax, rbx
jne 0x14005c80f
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14005c864
mov qword [rsp + 0x30], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14005c85f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14005c85f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rsi, qword [rsp + 0x30]
mov edx, 0x28
mov rcx, rbx
call fcn.140038810
mov rdi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14005ef10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x14005f007
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x14005ef98
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x14005ef70
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14005e790
mov dword [r14], eax
test eax, eax
jne 0x14005f032
mov rcx, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rcx + 0x48]
call fcn.140069dc0
mov dword [r14], eax
test eax, eax
jne 0x14005f032
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14005ec50
test eax, eax
je 0x14005f007
mov ecx, dword [rsi]
test eax, ecx
jne 0x14005f02b
or ecx, eax
xor r8d, r8d
mov dword [rsi], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.14005fe00
cmp al, 2
jne 0x14005f007
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x14005ef50
mov eax, reloc.OLEAUT32.dll_SafeArrayCopy
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov eax, 0x37
jmp 0x14005f00c
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.14005fe00
cmp al, 2
jne 0x14005f0a5
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x14005f0a5
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x14005f08d
lea rax, [rsp + 0x20]
sub r11, rax
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x14005f063
lea rcx, [rsp + 0x20]
call fcn.14005ec50
cmp eax, 0x10
jne 0x14005f0a5
or dword [rsi], eax
xor eax, eax
jmp 0x14005f00c
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x14005f00c
Function at 0x140061420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, r9d
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
cmp r8, 0xffffffffffffffff
jne 0x140061473
movzx eax, byte [rdx]
mov edi, ecx
test al, al
je 0x140061467
imul ecx, ecx, 0x1003f
inc rdi
movzx eax, al
add ecx, eax
movzx eax, byte [rdi + rdx]
test al, al
jne 0x140061451
test rdi, rdi
jne 0x14006149f
xor eax, eax
jmp 0x140061522
mov rdx, rcx
test r8, r8
je 0x140061467
nop dword [rax + rax]
movzx eax, byte [rdx + rsi]
test al, al
je 0x14006149a
imul ecx, ecx, 0x1003f
inc rdx
add ecx, eax
cmp rdx, r8
jb 0x140061480
jmp 0x140061467
mov ecx, 0x11
mov eax, dword [rbx + 0x128]
mov edx, ecx
xor edx, ebp
mov qword [rsp + 0x30], r14
mov r14d, 0xffffffff
cmp ebp, r14d
cmove edx, ecx
movzx ecx, byte [rbx + 0x12c]
imul rax, rdx
shr rax, cl
imul eax, dword [rbx + 0x120]
mov rbx, qword [rbx + 0x110]
sub edx, eax
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x14006151a
mov eax, dword [rbx + 0x30]
cmp eax, edi
jne 0x140061509
cmp dword [rbx + 0x14], ebp
jne 0x140061509
lea rcx, [rbx + 0x34]
cmp eax, 0xb
jbe 0x1400614fa
mov rcx, qword [rbx + 0x38]
mov r8d, edi
mov rdx, rsi
call fcn.140084360
test eax, eax
je 0x140061511
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400614e1
test rbx, rbx
je 0x14006151a
mov r14d, dword [rbx + 0xc]
mov eax, r14d
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14006b710
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
cmp dword [0x14014de98], 0
jne 0x14006b7f4
xorps xmm0, xmm0
mov word [rbp - 0x79], 2
xor eax, eax
lea rcx, [rbp - 0x79]
movups xmmword [rbp - 0x77], xmm0
mov dword [rbp + 0x19], eax
movups xmmword [rbp - 0x67], xmm0
mov word [rbp + 0x1d], ax
movups xmmword [rbp - 0x57], xmm0
movups xmmword [rbp - 0x47], xmm0
movups xmmword [rbp - 0x37], xmm0
movups xmmword [rbp - 0x27], xmm0
movups xmmword [rbp - 0x17], xmm0
movups xmmword [rbp - 7], xmm0
movups xmmword [rbp + 9], xmm0
call fcn.14006aae0
lea rcx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [rbp - 0x79]
movaps xmm1, xmmword [rbp - 0x69]
mov eax, dword [rbp + 0x47]
movaps xmmword [0x14014de00], xmm0
movaps xmmword [0x14014de10], xmm1
movaps xmm1, xmmword [rbp - 0x49]
movaps xmmword [0x14014de30], xmm1
movaps xmm1, xmmword [rbp - 0x29]
movaps xmmword [0x14014de50], xmm1
movaps xmm1, xmmword [rbp - 9]
mov dword [rbp - 0x59], eax
movaps xmm0, xmmword [rbp - 0x59]
movaps xmmword [0x14014de20], xmm0
movaps xmm0, xmmword [rbp - 0x39]
movaps xmmword [0x14014de40], xmm0
movaps xmm0, xmmword [rbp - 0x19]
movaps xmmword [0x14014de60], xmm0
movaps xmm0, xmmword [rbp + 7]
movaps xmmword [0x14014de70], xmm1
movsd xmm1, qword [rbp + 0x17]
movaps xmmword [0x14014de80], xmm0
movsd qword [0x14014de90], xmm1
mov dword [0x14014de98], 1
lea rax, [0x14014de00]
add rsp, 0xf0
pop rbp
ret

Function at 0x14006ba50
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, dword [0x14014de9c]
nop
test eax, eax
jne 0x14006bab7
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec eax
mov ecx, eax
shr ecx, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or eax, ecx
mov ecx, eax
shr ecx, 4
or ecx, eax
mov edx, ecx
shr edx, 8
or edx, ecx
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x60]
mov qword [0x14014dea0], rax
mov eax, 1
xchg dword [0x14014de9c], eax
mov rax, qword [0x14014dea0]
add rsp, 0x58
ret

Function at 0x14006bc30
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, r8b
mov rax, rdx
shr rax, 6
mov r10, rcx
lea rax, [rcx + rax*8]
mov r8, 0xffffffffffffffff
movzx ecx, dl
and cl, 0x3f
lea rdx, [r9 - 1]
xor rdx, qword [rax]
shl r8, cl
and r8, rdx
jne 0x14006bc6d
nop
add rax, 8
lea r8, [r9 - 1]
xor r8, qword [rax]
je 0x14006bc60
sub rax, r10
sar rax, 3
bsf rcx, r8
shl rax, 6
add rax, rcx
ret
Function at 0x140077e6c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140077ef3
mov rsi, rbx
cmp word [rax], bp
je 0x140077eb2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140077e9c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140077e98
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140029fd4
mov rdi, rax
test rax, rax
je 0x140077ee0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140083920
mov rbp, rdi
xor ecx, ecx
call fcn.140027678
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140078d40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140078d68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140078d68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001430
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x28]
mov eax, dword [rax + 0x68]
or eax, 0x20
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x28]
mov dword [rcx + 0x68], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
xor edx, edx
lea rcx, [0x140001380]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001487
jmp 0x140001506
lea rcx, [0x1400013b0]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400014a1
jmp 0x140001506
lea rcx, [0x1400013d0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400014bb
jmp 0x140001506
mov rcx, qword [rsp + 0x40]
call section..text
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400014e2
mov edx, dword [rsp + 0x20]
lea rcx, [0x14000d910]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001506
mov rax, qword [rsp + 0x40]
lea rcx, [fcn.140001310]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsp + 0x40]
call fcn.140001590
xor eax, eax
test eax, eax
jne 0x14000146b
cmp dword [rsp + 0x20], 0
je 0x140001517
mov rcx, qword [rsp + 0x40]
call fcn.140001310
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140003710
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb8], rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
movzx eax, al
cmp eax, 1
jle 0x140003749
int 0x2c
mov dword [rsp + 0x64], 0
jmp 0x140003751
mov dword [rsp + 0x64], 1
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x28], 0
je 0x140003767
xor eax, eax
jmp 0x140003930
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xd0]
add rax, 0xb0
mov rdx, rax
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x240
lea rax, [rsp + 0x98]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0xa8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xd0]
add rax, 0x28
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x68]
mov edx, 0x100004
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x140003875
mov eax, dword [rsp + 0x60]
jmp 0x140003930
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0xa1], 1
mov rax, qword [rsp + 0xd0]
add rax, 0xa8
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140002c50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x14000390a
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [rsp + 0xd0]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0xa1], 0
mov eax, dword [rsp + 0x60]
jmp 0x140003930
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0xa2]
movzx eax, al
test eax, eax
jne 0x14000392c
mov ecx, 0x64
call fcn.140004180
jmp 0x14000390a
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140001860
add rsp, 0xc0
pop rdi
ret
Function at 0x140004210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
movzx eax, al
test eax, eax
je 0x14000424d
int 0x2c
mov dword [rsp + 0x60], 0
jmp 0x140004255
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x14000427c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400042ed
call fcn.140002f80
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140001860
add rsp, 0x90
pop rdi
ret