joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Pagestats_tdist_tuserpics_twalk_tcrawltrack_treserve_tpersonalize_twebx_tnegocios_tleocinema_tstatistics_tserialized_tsimpleforum_tdlg_tsidebars_tcatimages_tguatemala_tlisence_taustria_tmyarticles_tred_tcasino_tinetpub_tsecurityroles_tmodcp_tcampeggio_tstreamrotator_tschool_tmr_tcodelib_tvf_tscene_tusd_tjason_tfast_tweb_thitfotos_tpermalink_teditsaved_tspecialoffer_tchm_tsharp_twinner_tpass_ttestserver_tlinker_twebdemo
mov r10, rax
sub rbx, rax
movabs rdi, 0xadd5e6323fd48a87
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x179
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b110
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000b172
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000d510
test al, al
jne 0x14000b184
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000b140
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x64
mov dword [rbp - 0x20], 0x24001b
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b0035
mov dword [rbp - 0x18], 0x380036
mov dword [rbp - 0x14], 0x350023
mov dword [rbp - 0x10], 0x4c0020
call fcn.140004fd0
mov rcx, rax
call 0x14000b110
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x24001b
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b0035
mov dword [rbp - 0x18], 0x380036
mov dword [rbp - 0x14], 0x460052
call fcn.1400022a0
mov rcx, rax
call 0x14000b110
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x15003e
mov dword [rbp - 0x1c], 0x90003
mov dword [rbp - 0x18], 0x74001f
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000b110
Function at 0x14000d420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000b172
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000d510
test al, al
jne 0x14000b184
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000b140
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x64
mov dword [rbp - 0x20], 0x24001b
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b0035
mov dword [rbp - 0x18], 0x380036
mov dword [rbp - 0x14], 0x350023
mov dword [rbp - 0x10], 0x4c0020
call fcn.140004fd0
mov rcx, rax
call 0x14000b110
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x24001b
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b0035
mov dword [rbp - 0x18], 0x380036
mov dword [rbp - 0x14], 0x460052
call fcn.1400022a0
mov rcx, rax
call 0x14000b110
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x15003e
mov dword [rbp - 0x1c], 0x90003
mov dword [rbp - 0x18], 0x74001f
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000b110
Function at 0x14000e8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000eade
mov word [rbp + 0x50], 0x6150
mov word [rbp + 0x58], 0x6150
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e964
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e950
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e995
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e980
cmp rdi, rbx
jne 0x14000eab2
mov r13, rsi
mov word [rbp - 0x50], 0x6150
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e9d6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e9c2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000ead8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x610031
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000ea48
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x61002a
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000ea48
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x610031
mov dword [rbp - 0x42], 0x610011
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x610031
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000eaa5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x61002a
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000eaa5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x610031
mov dword [rbp - 0x32], 0x610011
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000eab2
inc r14
jmp 0x14000e9b0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000eade
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e920
mov rax, qword [rbp - 8]
jmp 0x14000eae0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ec50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x90003
mov dword [rbp - 0x1c], 0x90002
mov dword [rbp - 0x18], 0x47001f
mov dword [rbp - 0x14], 0x5a0053
mov dword [rbp - 0x10], 0x650017
mov dword [rbp - 0xc], 0x690008
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 0x80007
mov dword [rbp - 0x1c], 0xc0009
mov dword [rbp - 0x18], 0x11001d
mov dword [rbp - 0x14], 0x5a0015
mov dword [rbp - 0x10], 0x650017
mov dword [rbp - 0xc], 0x690008
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015500]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x3205
mov byte [rbp - 0xe], 0x72
call fcn.140004620
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x9020903
mov dword [rbp - 0x1c], 0x1119311f
mov dword [rbp - 0x18], 0xc107c10
mov word [rbp - 0x14], 0x7424
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x130f19
mov dword [rbp - 0x1c], 0x41a01
mov dword [rbp - 0x18], 0x701793c
mov word [rbp - 0x14], 0x7432
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400155b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 0x73
call fcn.140004330
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015550]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x70170917
call fcn.140002660
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400154e0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 0x73
call fcn.140004330
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015490]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x311c0a1a
mov byte [rbp - 0xc], 0x69
call fcn.140003130
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015530]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x241d
mov byte [rbp - 0xe], 0x72
call fcn.140004620
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x180004b14
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180004b98
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180016340]
cmp byte [rcx + rax], 0
je 0x180004b98
dec r8
sub rdx, 1
jne 0x180004b7e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x180005190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.180004bb0
mov ebx, eax
test eax, eax
jne 0x1800051c0
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x18000521c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180005213
test al, 0x10
je 0x180005213
bt eax, 0xa
jae 0x18000520c
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.180005234
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x180005208
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18000522c
test edi, edi
jne 0x180005213
and dword [rsp + 0x3c], 0
jmp 0x180005218
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.18000bc9c
int3
Function at 0x18000f948
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000f978
xor eax, eax
jmp 0x18000fa3b
mov rbp, rbx
cmp word [rax], si
je 0x18000f99d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000f984
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000f980
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000f868
movsxd r14, eax
test eax, eax
jne 0x18000f9db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000f971
mov rcx, r14
call fcn.18000d584
mov rdi, rax
test rax, rax
jne 0x18000f9f4
xor ecx, ecx
call fcn.18000d65c
jmp 0x18000f9d0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000f868
test eax, eax
jne 0x18000fa25
mov rcx, rdi
call fcn.18000d65c
jmp 0x18000fa2f
xor ecx, ecx
call fcn.18000d65c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800149c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800149e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800149e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400e4708
Capabilities:
Write file on windows

Disassembly:
jmp 0x14028da00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140373442]
call fcn.1400e88b7
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14028da57
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14028db63
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14028dafc
cmp qword [rbp + 0x28], 0
jle 0x14028dafc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14028da9c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400e8434
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14028db52
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14028db52
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400e4c3f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140266530
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1403731e0]
call fcn.1400e88b7
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x14026656c
mov rcx, qword [rbp + 0x100]
call fcn.1400e4e2e
jmp 0x140266587
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x140266587
mov rcx, qword [rbp + 0x100]
call fcn.1400e637d
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400e5fdb
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1401100a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x14034c280]
xor rax, rbp
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x308], 0
lea rcx, [0x140372568]
call fcn.1400e88b7
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400e624c
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400e6bf2
mov dword [rbp + 0x284], 0
call fcn.1400e7e0d
mov dword [rbp + 0x2a4], eax
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400e46ae
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x140110186
mov qword [rbp + 0x4e0], 0
jmp 0x140110271
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x3fffffff
jle 0x1401101b7
mov qword [rbp + 0x4e8], 0
jmp 0x140110263
movsxd rax, dword [rbp + 0x284]
shl rax, 1
mov qword [rbp + 0x4f0], rax
movsxd rcx, dword [rbp + 0x284]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x4f8], rcx
mov rcx, qword [rbp + 0x4f8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x4f8]
ja 0x1401101fb
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e4d0c
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x308]
mov rdx, qword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x500]
call fcn.1400e8f83
add qword [rbp + 0x500], 0x20
mov r9d, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x4f0]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x500]
call fcn.1400e5946
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400e8fdd
test eax, eax
jne 0x1401102b2
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x4a4], eax
mov rcx, qword [rbp + 0x538]
call fcn.1400e4d4d
mov eax, dword [rbp + 0x4a4]
jmp 0x1401102f3
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400e7e80
test eax, eax
jne 0x14011014e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x4c4], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400e4d4d
mov eax, dword [rbp + 0x4c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402c0a80]
mov r8, qword [rbp + 0x308]
call fcn.1400e6f3a
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.1400e62f6
lea rsp, [rbp + 0x518]
pop rdi
pop rbp
ret