joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 7
mov rcx, qword [0x14007e460]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [0x14007413b], 0
mov eax, dword [0x140074138]
mov dword [rsp + 0x38], eax
je 0x140002063
xor r8d, r8d
cmp dword [0x14007d090], 2
jl 0x140002025
movdqa xmm3, xmmword [0x1400758b0]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140075d40]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140075d40]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.8888]
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmmword [0x140075920]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [str.9999999999999999]
xorps xmm3, xmm0
movd dword [rsp + 0x38], xmm3
jmp 0x140002063
lea r9, [rsp + 0x38]
nop word [rax + rax]
mov eax, 0x24924925
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x140002030
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x38]
call fcn.14000c090
mov rcx, qword [0x14007e460]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [0x14007413d], 0
lea rdx, [rsp + 0x38]
movzx eax, word [0x14007413c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov word [rsp + 0x38], ax
je 0x1400020b1
xor byte [rsp + 0x39], 0x3a
mov byte [rsp + 0x38], 0x3d
call fcn.14000c090
mov rcx, qword [0x14007e460]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, word [0x140050edc]
lea rdx, [rsp + 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov word [rsp + 0x38], ax
movzx eax, byte [0x140050ede]
xor byte [rsp + 0x39], 0x3a
xor al, 0x3b
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x38], 0x5d
call fcn.14000c090
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c090
Function at 0x140002110
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 7
mov rcx, qword [0x14007e460]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [0x14007413b], 0
mov eax, dword [0x140074138]
mov dword [rsp + 0x38], eax
je 0x140002203
xor r8d, r8d
cmp dword [0x14007d090], 2
jl 0x1400021c5
movdqa xmm3, xmmword [0x1400758b0]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140075d40]
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140075d40]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.8888]
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmmword [0x140075920]
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [str.9999999999999999]
xorps xmm3, xmm0
movd dword [rsp + 0x38], xmm3
jmp 0x140002203
lea r9, [rsp + 0x38]
nop word [rax + rax]
mov eax, 0x24924925
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x39
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x1400021d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x38]
call fcn.14000c090
mov rcx, qword [0x14007e460]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [0x140074191], 0
lea rdx, [rsp + 0x38]
movzx eax, word [0x140074190]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov word [rsp + 0x38], ax
je 0x140002251
xor byte [rsp + 0x39], 0x3a
mov byte [rsp + 0x38], 0x2b
call fcn.14000c090
mov rcx, qword [0x14007e460]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, word [0x140050edc]
lea rdx, [rsp + 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov word [rsp + 0x38], ax
movzx eax, byte [0x140050ede]
xor byte [rsp + 0x39], 0x3a
xor al, 0x3b
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x38], 0x5d
call fcn.14000c090
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000c090
Function at 0x14000b8a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14007e370]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14007e500]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14007e3f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14007e4c0]
call qword [sym.imp.USER32.dll_DestroyWindow]
movups xmm3, xmmword [0x1400740a0]
movzx eax, byte [0x1400740b0]
xor ecx, ecx
cmp dword [0x14007d090], 2
movups xmmword [rsp + 0x20], xmm3
mov byte [rsp + 0x30], al
jl 0x14000bad4
movdqa xmm5, xmmword [0x140075d40]
movdqa xmm2, xmmword [0x1400758b0]
movdqa xmm4, xmmword [0x140075920]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x1400758d0]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [str.8888]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [str.9999999999999999]
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x1400758c0]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
pmuldq xmm1, xmm5
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x1400758e0]
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
pmuldq xmm1, xmm5
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
mov ecx, 0x10
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x50]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x40]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x14000bae0
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004dea0
add rsp, 0x68
ret
Function at 0x14000de70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000decd
lea rbx, [0x14006f8b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000deb4
cmp r10, 2
jb 0x14000deb4
cmp byte [r9], r8b
jne 0x14000deb4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000de90
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000df0f
lea rbx, [0x14006f8b0]
cmp r8b, 0x23
jne 0x14000def3
cmp byte [r9], r8b
jne 0x14000def3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000dee0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000e050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000e06a
mov qword [r8], 0
lea rdx, [0x140074cfc]
call fcn.14000df20
mov rbx, rax
test rax, rax
jne 0x14000e08a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000e163
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000e163
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000e163
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000e163
cmp rdi, 0xffffffffffffffff
je 0x14000e163
mov rax, qword [0x14007e450]
test rax, rax
je 0x14000e100
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000e163
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000e150
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14007e450]
test rax, rax
je 0x14000e145
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000e16c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000e15e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000e16e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400116e0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14006f8b0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
sar eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r9d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [0x14007e450]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x140011778
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140024f20
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140011780
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x108]
lea r10, [0x14006f8b0]
mov rax, qword [rcx + 0xf0]
movss xmm1, dword [rcx + 0x10c]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xe8]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x14001e220
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14007e450]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x14001e281
cmp byte [rbx + 0x4a2e], 0
jne 0x14001e281
movsx r9d, word [rbx + 0x5b2a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000dd30
test dil, 1
je 0x14001e3a8
jmp 0x14001e30c
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b2a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140075774]
mov edx, 0x10
mulss xmm1, dword [0x140075764]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140075608]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
call fcn.14000dd30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001e360
lea r11, [0x14006f8b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001e343
cmp byte [r8], r9b
jne 0x14001e343
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001e330
not ecx
call fcn.140015590
test rax, rax
je 0x14001e3a8
cmp byte [rax + 0xae], 0
je 0x14001e3a8
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b2a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b2a]
call fcn.14000dd30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140017c30
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004dea0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140023790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c10], 0
lea rbx, [rcx + 0x5c18]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140023837
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400237ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140025e60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000e7e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c10]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c20]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14007e443]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002383f
mov rcx, rbx
call fcn.14000e7e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140023db0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14007e450]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140023e13
mov qword [rsp], rbx
lea rbx, [0x14006f8b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140023df3
cmp byte [r8], r9b
jne 0x140023df3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140023de0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b88]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140023e47
mov r10, qword [r10 + 0x5b90]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140023e4e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140023e34
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14004eb2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004eb76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004eb76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004eb76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004eb76
cmp dword [rcx + 0x84], 0xe
jbe 0x14004eb76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004eb78
xor al, al
add rsp, 0x28
ret

Function at 0x140001484
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rax + 8], 0
lea rdx, [rax + 8]
mov rdi, rcx
movsxd rcx, dword [rcx + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebp, eax
test eax, eax
jns 0x1400014ba
mov al, 1
jmp 0x14000158e
mov rax, qword gs:[0x188]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword [rsp + 0x60]
mov r14, qword [rcx + 0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x28]
mov cr3, rax
mov rbx, cr3
mov rsi, qword [rdi]
mov rcx, qword [rdi + 8]
add rcx, rsi
cmp rsi, rcx
ja 0x14000157e
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400015d4
movups xmm2, xmmword [rax + 0x10]
movups xmm1, xmmword [rax]
movq rax, xmm2
psrldq xmm2, 8
movdqa xmm0, xmm1
movq rcx, xmm2
psrldq xmm0, 8
or qword [rax], 4
movq rax, xmm0
or qword [rax], 4
movq rax, xmm1
or qword [rax], 4
test rcx, rcx
je 0x140001548
test byte [rcx], 1
je 0x14000154c
or qword [rcx], 4
mov rax, qword gs:[0x188]
mov rcx, qword [rax + 0x98]
mov qword [rcx + 0x20], r14
mov rax, qword [r14 + 0x28]
mov cr3, rax
mov rax, qword [rdi + 8]
add rsi, 0x1000
add rax, qword [rdi]
cmp rsi, rax
jbe 0x1400014f9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebp, ebp
setne al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ac40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180045028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.18000eb08
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x18000b490]
xor edx, edx
xor ecx, ecx
call fcn.180013d78
mov qword [rdi], rax
test rax, rax
je 0x18000acbb
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18000eae0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call fcn.18000b79c
int3

Function at 0x18000b4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x180045028]
xor rax, rsp
mov qword [rbp + 0x48], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x68], 0x6e72656b
mov dword [rsp + 0x30], 0x43746547
mov dword [rsp + 0x6c], 0x32336c65
mov dword [rsp + 0x34], 0x6f736e6f
mov dword [rbp + 0x15], 0x6f646e69
mov dword [rsp + 0x38], 0x6957656c
mov dword [rsp + 0x70], 0x6c6c642e
mov dword [rbp - 0x22], 0x6c6c642e
mov dword [rbp - 0x27], 0x33726573
mov dword [rsp + 0x3c], 0x776f646e
mov byte [rsp + 0x74], 0
mov word [rbp + 0x13], 0x5777
mov byte [rsp + 0x40], 0
mov byte [rbp - 0x23], 0x32
mov word [rbp + 0x10], 0x6853
mov byte [rbp + 0x12], 0x6f
mov word [rbp + 0x19], 0x77
mov byte [rbp - 0x28], 0x75
mov byte [rbp - 0x1e], 0
mov dword [rbp - 0x60], 0x6f6c6c41
mov dword [rbp - 0x5a], 0x6f736e6f
mov word [rbp - 0x5c], 0x4363
mov word [rbp - 0x56], 0x656c
mov byte [rbp - 0x54], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call rbx
test rax, rax
jne 0x18000b607
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
call rbx
lea rcx, [rbp - 0x28]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, rbx
call rax
call fcn.1800088d0
mov rdx, rax
test rax, rax
je 0x18000b67f
xor eax, eax
mov byte [rsp + 0x20], 0x90
mov qword [rsp + 0x21], rax
lea rbx, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
xor ecx, ecx
mov byte [rsp + 0x29], al
cmp r8, rdx
je 0x18000b657
nop word [rax + rax]
mov eax, ecx
add rbx, 8
inc ecx
cmp eax, 0x1388
jge 0x18000b67f
mov r8, qword [rbx]
cmp r8, rdx
jne 0x18000b640
mov rdx, rbx
lea rcx, str.stack:__p_____p_r_n
call fcn.180001120
lea r8, [0x18000b4c0]
mov rdx, rbx
lea rcx, str.stack:__p_____p_r_n
mov qword [rbx], r8
call fcn.180001120
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.18000eae0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rbp
ret