joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f180
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f406
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f3fa
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x0062ad74], 0
jne 0x42f1da
xor edx, edx
xor ebx, ebx
jmp 0x42f220
xor edx, edx
jmp 0x42f205
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041e560
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f1de
add rax, 0x1268
call fcn.0042f100
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42f394
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42f21b
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00412760
test rax, rax
jne 0x42f26c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f21b
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42f2ac
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f21b
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42f3ed
lea r10, [0x005fd158]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42f32f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42f365
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f21b
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f3e5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42f21b
cmp rbx, 0x200
ja 0x42f3d4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00424d80
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042f100
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00461d00
mov rax, r8
call fcn.00461c80
mov rax, r8
mov ecx, 0x40
call fcn.00461ca0
mov edx, 0x200
nop
call fcn.00461ce0
nop
mov qword [rsp + 8], rax
call fcn.004665a0
mov rax, qword [rsp + 8]
jmp fcn.0042f180
Function at 0x4441e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444347
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4441f2
cmp edx, ecx
jne 0x444335
nop word [rax + rax]
test rsi, rsi
jne 0x444335
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444254
nop
call fcn.00463540
xorps xmm15, xmm15
mov r14, qword [0x0062aff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00444100
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444330
mov rdx, qword [0x005d7548]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444325
mov rcx, qword [0x005d7540]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005d81b0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005d81b0], rax
nop
mov edx, 1
lea rsi, [0x005d81b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x444313
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00509ced]
mov ebx, 0x28
nop
call fcn.00435640
mov rax, rsi
mov rcx, rdx
call fcn.00461c80
call fcn.00433ce0
lea rax, [0x00508e3f]
mov ebx, 0x23
call fcn.00435640
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004441e0
Function at 0x44f6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44f817
movzx edx, byte [rax]
test edx, edx
jne 0x44f6d4
nop dword [rax]
test r8b, r8b
jne 0x44f6d4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44f6e7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44f7d7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44f7c5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44f7b7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44f73d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44f780
mov eax, 1
cmp rax, rbx
ja 0x44f76b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00461d40
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44f7af
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44f773
mov rcx, r11
mov eax, r12d
jmp 0x44f742
mov rcx, rbx
call fcn.00461c80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00461c80
mov eax, r8d
mov rcx, rbx
call fcn.00461d40
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44f80d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44f7d0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44f6ed
mov eax, edx
mov rcx, rbx
call fcn.00461c80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00461c80
nop
int3
Function at 0x456d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x456e2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00456e80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045f8c0
xorps xmm15, xmm15
mov r14, qword [0x0062aff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045fa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00456d80
Function at 0x4617e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4039c3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409420
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4039a0
cmp byte [0x0062ad6d], 0
je 0x4617f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45ea40
jmp 0x4039a0

Function at 0x461800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0062b100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0062ad6d], 0
je 0x461835
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0062b3e0]
aesenc xmm0, xmmword [0x0062b3f0]
aesenc xmm0, xmmword [0x0062b400]
movq rax, xmm0
ret
jmp 0x409640

Function at 0x461840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0062b100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0062ad6d], 0
je 0x461876
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0062b3e0]
aesenc xmm0, xmmword [0x0062b3f0]
aesenc xmm0, xmmword [0x0062b400]
movq rax, xmm0
ret
jmp 0x4096a0

Function at 0x4635a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4635d4
mov rcx, 0x28
jmp 0x4635df
shl rcx, 3
add rcx, 0x1480
mov qword [0x0062aff0], rcx
pop rbp
ret
Function at 0x47aa20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47aaea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403880
xorps xmm15, xmm15
mov r14, qword [0x0062aff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47aacf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004e0280]
xor ebx, ebx
mov rcx, rdx
call fcn.004484e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047b620
inc rbx
cmp rcx, rbx
jae 0x47aabe
mov edi, 1
lea rsi, [0x004e0280]
call fcn.004485c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0052cad8]
lea rsi, [0x0052bf68]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fa00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047aa20

Function at 0x4b3f60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4b4035
movdqa xmm0, xmmword [0x0052c0c0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4b3fa1
movdqa xmm0, xmmword [0x0052c0d0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4b40b7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4b408b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0052bf50]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0052c0e0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4c0620
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4c0637
inc rax
cmp rax, 4
jge 0x4c064f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4c0634
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4c0660
inc rax
cmp rax, 4
jge 0x4c066e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4c0697
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4c067b
jmp 0x4c065d

Function at 0xb27058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b271df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xb27089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb2706f
add dl, dl
jne 0xb27096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb270f6
xor eax, eax
add dl, dl
jne 0xb270a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb271ad
add dl, dl
jne 0xb270b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb270c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb270d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb270dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xb270ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xb2707e
mov eax, 1
add dl, dl
jne 0xb27106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb27113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb270fb
sub eax, ebx
mov ebx, 1
jne 0xb2714c
mov ecx, 1
add dl, dl
jne 0xb2712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb2713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb27123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb2707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb27168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb27175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb2715d
cmp eax, 0x7d00
jae 0xb2719b
cmp eax, 0x500
jb 0xb27196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb2707e
cmp eax, 0x7f
ja 0xb2719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb2707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xb271d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xb2707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002b00
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x480
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [0x140027cc0]
xor r15d, r15d
mov qword [rsp + 0x50], rax
mov rbp, r9
mov qword [rsp + 0x68], r15
mov r14d, r8d
mov rbx, rdx
movzx edi, cl
call fcn.1400035b0
mov r8, rax
lea rdx, str._________Han._s_event_message_at__s__________n
mov r9, rbx
lea rcx, [rsp + 0x270]
call fcn.140002a90
lea eax, [rdi - 0x57]
lea esi, [r15 + 4]
test al, 0xdf
jne 0x140002b79
lea esi, [r15 + 2]
sub dil, 0x45
test dil, 0xdf
jne 0x140002b88
mov esi, 1
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServicesEventlogApplication]
lea rax, [rsp + 0x270]
mov qword [rsp + 0x60], rbp
movups xmm1, xmmword [0x140027d08]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x70]
mov eax, dword [0x140027d28]
dec rcx
mov dword [rsp + 0xa0], eax
movzx eax, word [0x140027d2c]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x140027d18]
mov word [rsp + 0xa4], ax
movzx eax, byte [0x140027d2e]
mov byte [rsp + 0xa6], al
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x90], xmm0
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002bf6
mov eax, dword [str.HAN.]
mov dword [rcx], eax
movzx eax, word [0x140027d34]
mov word [rcx + 4], ax
lea rcx, [rsp + 0x70]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002c20
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002c30
lea r9, str._Systemdrive_MgrHanEvents.dll
lea r8, str.EventMessageFile
lea rdx, [rsp + 0x70]
lea rcx, str.HKLM
call fcn.140004ea0
test eax, eax
je 0x140002c78
xor r8d, r8d
lea rdx, [0x140027d74]
lea rcx, [0x140027d78]
call fcn.140004940
mov r9d, 7
lea r8, str.TypesSupportet
lea rdx, [rsp + 0x70]
lea rcx, str.HKLM
call fcn.140004dd0
test eax, eax
je 0x140002cb0
xor r8d, r8d
lea rdx, [0x140027d74]
lea rcx, [0x140027d78]
call fcn.140004940
mov eax, dword [str.Han.]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
dec rcx
movzx eax, byte [0x140027d94]
mov byte [rsp + 0x74], al
nop dword [rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140002cd0
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002ce0
lea rdx, [rsp + 0x70]
lea rcx, [0x1400276b8]
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov rbx, rax
mov r9d, r14d
lea rax, [rsp + 0x50]
movzx edx, si
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], r15d
mov word [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400092f0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002d70
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rbx
mov eax, 0x250
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r8d, 0x20
lea rdx, [rsp + 0x20]
lea rcx, str._AsJob
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140002ff6
lea rcx, str.C:MgrRun_
call fcn.1400033b0
test eax, eax
je 0x140002ff6
call fcn.140003020
mov rdx, rax
lea rcx, str.Han0
mov r8d, 4
call fcn.140003f20
test eax, eax
jne 0x140002ff6
mov byte [rsp + 0x20], al
mov word [rsp + 0x140], ax
call fcn.140003520
mov r9, rax
lea rdx, [rsp + 0x140]
xor r8d, r8d
xor ecx, ecx
call fcn.140003100
movups xmm0, xmmword [str.C:MgrRun_]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x140027db0]
movsd qword [rsp + 0x50], xmm0
call fcn.140003090
lea rcx, [rsp + 0x40]
mov r8, rax
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002e40
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140002e50
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002e70
movsd xmm0, qword [str._Run_]
mov eax, dword [0x140027dc8]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002ea0
lea r8, [rsp + 0x140]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140002ec0
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002ee0
movsd xmm0, qword [str..log]
lea rdx, [rsp + 0x20]
movzx eax, word [0x140027dd8]
mov r8d, 0x20
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, str._Job
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140002f3e
call fcn.140006540
lea rdx, [rsp + 0x20]
sub rdx, rax
nop dword [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140002f30
lea rcx, [rsp + 0x40]
call fcn.140005160
mov rbx, rax
test rax, rax
je 0x140002ff6
call fcn.1400035b0
mov rdx, rax
mov rcx, rbx
call fcn.140005b00
lea rdx, [0x140027ddc]
mov rcx, rbx
call fcn.140005b00
call fcn.140003020
mov rdx, rax
mov rcx, rbx
call fcn.140005b00
lea rdx, [0x140027ddc]
mov rcx, rbx
call fcn.140005b00
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140005b00
lea rcx, [rsp + 0x20]
call fcn.1400065d0
cmp eax, 0x10
jge 0x140002fc6
mov r8d, 0x10
lea rdx, [0x140027de0]
sub r8d, eax
mov rcx, rbx
call fcn.1400059e0
lea rdx, [0x140027ddc]
mov rcx, rbx
call fcn.140005b00
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
mov rcx, rbx
call fcn.140005b00
mov rcx, rbx
call fcn.140005cf0
mov rcx, rbx
call fcn.140004fc0
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400092f0
add rsp, 0x250
pop rbx
ret
Function at 0x140003020
Capabilities:
Get hostname

Disassembly:
push rbx
mov eax, 0x20
call fcn.140009290
sub rsp, rax
cmp byte [0x140036868], 0
mov dword [rsp + 0x30], 0x10
jne 0x140003079
lea rbx, [0x140036868]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x140003070
lea r8d, [rax + 1]
lea rdx, str.GetComputerName
lea rcx, str.ss_host
call fcn.140004940
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x140036868]
add rsp, 0x20
pop rbx
ret

Function at 0x140003090
Capabilities:
Get hostname

Disassembly:
push rbx
mov eax, 0x20
call fcn.140009290
sub rsp, rax
cmp word [0x140036878], 0
mov dword [rsp + 0x30], 0x10
jne 0x1400030ea
lea rbx, [0x140036878]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400030e1
lea r8d, [rax + 1]
lea rdx, [0x140027df8]
lea rcx, str.ss_host
call fcn.140004940
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x140036878]
add rsp, 0x20
pop rbx
ret

Function at 0x1400033b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
mov eax, 0x20
call fcn.140009290
sub rsp, rax
lea rdx, [0x140027e50]
mov rbx, rcx
call fcn.140004000
test eax, eax
je 0x1400033eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140003460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x28
call fcn.140009290
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003483
shr eax, 4
and eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret