joyce8/EMBER2024-capa huggingface dataset:
Function at 0x231975bb0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231975bd8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
jne 0x231975c01
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x231975c18
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x231975c40
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x231975c03
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x231975c03

Function at 0x231975c70
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231975c98
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
jne 0x231975cc4
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x231975ce0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call sym.pthread_mutex_timedlock
test eax, eax
mov edi, eax
je 0x231975d10
cmp eax, 0x8a
je 0x231975d40
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, edi
jmp 0x231975cc6
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x231975cc6
lock add dword [rsi + 0x10], 1
jmp 0x231975cfc

Function at 0x231975d50
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231975d78
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_trylock
test eax, eax
jne 0x231975da1
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x231975db8
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x231975de0
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x231975da3
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x231975da3
Function at 0x231975e10
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231975e38
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x231975e8e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x231975ec8
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x231975e8e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x231975e81
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x231975ea0
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x231975ec0
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x231975e8e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x231975e8e

Function at 0x231975ee0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x231975f60
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x231975f38
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x231975f1f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x231975f70
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x231975f1f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x231975f1f
Function at 0x231975f90
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231975fb8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x231976009
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x2319760a0
mov edx, dword [rsi + 8]
test edx, edx
jne 0x231976004
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x231976000
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x231976020
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x23197606f
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x2319760b0
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x231976068
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x231976009
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x231976009
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x231976004
Function at 0x2319760d0
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x231976180
test rdx, rdx
je 0x231976180
call sym.rwl_ref.constprop.0
test eax, eax
je 0x231976110
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x231976167
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x231976198
mov edx, dword [rdi + 8]
test edx, edx
jne 0x23197615f
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x23197615b
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x2319761a8
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x231976164
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x2319761f4
test ebp, ebp
jne 0x23197620b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x2319761f0
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x231976230
mov dword [rdi + 0xc], 0
jmp 0x23197615f
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x231976164

Function at 0x23198a4b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x23198a4dc
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x23198b0f0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x231ec6260], 0
jne 0x23198b1f6
mov byte [0x231ec6260], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x23198b1cc
mov rbx, qword [rax + 8]
lea r9, [rsp + 0x2c]
xor eax, eax
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
mov r8d, 0x30
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x23198b1bd
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x231ec7191]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x23198b1b8
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x23198b187
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x23198b28b
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x23198b1f1
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x23198b1f1

Function at 0x2319eb900
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
cmp eax, 0xffffffff
movsxd rbp, eax
je 0x2319eb948
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x2319eb91a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x2319fe4d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
test rax, rax
mov rdi, rcx
je 0x2319fe4f8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea rsi, [rsp + 0x2c]
mov ebx, 4
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x2319fe540
cdqe
add rsi, rax
sub rbx, rax
jne 0x2319fe510
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x2319fe54c
call rbp
cmp dword [rax], 4
je 0x2319fe510
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10040135b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.100402240
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1004013cb
lea rax, str.VirtualAlloc_failed.
mov rdx, rax
mov rax, qword [sym.imp.cygstdc_6.dll_std::cerr]
mov rcx, rax
call fcn.100401668
mov rcx, rax
mov rax, qword [0x100446c20]
mov rdx, rax
call fcn.1004016f0
jmp 0x1004013ff
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.100402240
mov rbx, rax
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.100402210
mov rdx, rax
mov rax, qword [rbp - 8]
mov r8, rbx
mov rcx, rax
call sub.cygwin1.dll_memcpy
mov rax, qword [rbp - 8]
call rax
nop
add rsp, 0x38
pop rbx
pop rbp
ret
Function at 0x140001070
Capabilities:
Execute command
Extract resource via kernel32 functions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
call fcn.140001290
mov r8, qword [rax + 0x40]
cmp word [r8 + 0x18], 0
je 0x1400010af
nop
mov rax, qword [rax]
mov r8, qword [rax + 0x40]
cmp word [r8 + 0x18], 0
jne 0x1400010a0
mov rsi, qword [rax + 0x10]
xor ebx, ebx
mov edi, ebx
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov r15d, dword [rcx + 0x1c]
mov r12d, dword [rcx + 0x20]
add r15, rsi
mov r13d, dword [rcx + 0x24]
add r12, rsi
mov r14d, dword [rcx + 0x18]
add r13, rsi
test r14, r14
je 0x14000110f
movzx eax, word [r13 + rdi*2]
lea rdx, str.GetProcAddress
mov ecx, dword [r12 + rdi*4]
add rcx, rsi
mov ebp, dword [r15 + rax*4]
add rbp, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140001117
inc rdi
cmp rdi, r14
jb 0x1400010e3
mov rbp, qword [rsp + 0x80]
lea rdx, str.VirtualProtect
mov rcx, rsi
call rbp
lea rdx, str.CreateThread
mov rcx, rsi
call rbp
lea rdx, str.WaitForSingleObject
mov rcx, rsi
call rbp
lea rdx, str.VirtualAlloc
mov rcx, rsi
call rbp
cmp dword [rsp + 0x70], 2
mov rdi, rax
jne 0x140001250
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x383939
mov rcx, qword [rcx + 8]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140001185
inc rcx
test edx, edx
jne 0x140001170
test r8d, r8d
jne 0x140001230
lea r8, [0x140002300]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, esi
lea rcx, [0x1400022b0]
mov rbx, rax
call fcn.140001010
movsxd rdx, esi
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call rdi
mov r8d, esi
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, 0x58
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.xxxxxxxxxxxxx_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
jmp 0x140001265
mov edx, ebx
lea rcx, [0x1400022b0]
call fcn.140001010
inc ebx
cmp ebx, 0x58
jl 0x140001230
jmp 0x140001265
mov edx, ebx
lea rcx, [0x1400022b0]
call fcn.140001010
inc ebx
cmp ebx, 0x64
jl 0x140001250
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140001290
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret
Function at 0x140008400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140008461
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140008420
mov ecx, dword [r9]
jmp 0x14000854b
cmp ecx, 0x4e0
jb 0x14000854b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140008480
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400084d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000a220
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000a27d
lea rbx, [0x1401148e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000a264
cmp r10, 2
jb 0x14000a264
cmp byte [r9], r8b
jne 0x14000a264
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000a240
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000a2bf
lea rbx, [0x1401148e0]
cmp r8b, 0x23
jne 0x14000a2a3
cmp byte [r9], r8b
jne 0x14000a2a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000a290
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000a400
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000a41a
mov qword [r8], 0
lea rdx, [0x140114430]
call fcn.14000a2d0
mov rbx, rax
test rax, rax
jne 0x14000a43a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.140095e60
mov esi, eax
cmp eax, 0xffffffff
je 0x14000a50a
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.140097430
test eax, eax
jne 0x14000a50a
mov rcx, rbx
call fcn.140095e60
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000a50a
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140097430
test eax, eax
jne 0x14000a50a
cmp rdi, 0xffffffffffffffff
je 0x14000a50a
mov rax, qword [0x140162f80]
test rax, rax
je 0x14000a4ac
inc dword [rax + 0xf4]
mov rcx, rdi
call fcn.140094dc0
mov rsi, rax
test rax, rax
je 0x14000a50a
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.140099590
mov rcx, rbx
cmp rax, rdi
je 0x14000a4f8
call fcn.140096c10
mov rax, qword [0x140162f80]
test rax, rax
je 0x14000a4ee
dec dword [rax + 0xf4]
mov rcx, rsi
call fcn.1400941c0
jmp 0x14000a512
call fcn.140096c10
test r14, r14
je 0x14000a505
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000a514
mov rcx, rbx
call fcn.140096c10
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000dbc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1401148e0]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x14000dc54
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140021c50
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dc70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x1401148e0]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret