joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180052a68
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
cmp byte [0x1800d56a2], r14b
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
je 0x180052c8e
mov rax, qword [0x1800d5ea0]
test rax, rax
jne 0x180052b49
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180052b2e
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180052b2e
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180052b2a
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180052b07
cmp r11d, 0x95466b05
je 0x180052bc3
test edx, edx
jne 0x180052aeb
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x180052b3f
cmp qword [rax + 0x30], r14
jne 0x180052ac7
mov rax, r14
mov qword [0x1800d5ea0], rax
mov ecx, dword [0x1800d040c]
call rax
test ax, ax
jns 0x180052c8e
call fcn.18004d014
mov rbx, rax
test rax, rax
je 0x180052c8e
cmp dword [0x1800d0438], 1
jne 0x180052c8e
movss xmm9, dword [0x1800d13f0]
lea rcx, [rbp - 0x50]
movss xmm6, dword [0x1800d13f4]
xor r8d, r8d
mulss xmm9, dword [0x180059af4]
mov rdx, rax
mulss xmm6, dword [0x180059af4]
call fcn.18004ccd4
mov ecx, dword [0x1800d56b0]
sub ecx, 1
je 0x180052be8
sub ecx, 1
je 0x180052be0
cmp ecx, 1
jne 0x180052bfa
mov r8d, ecx
jmp 0x180052bee
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180052b42
mov r8d, 8
jmp 0x180052bee
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18004ccd4
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov ebx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.180052044
movss xmm0, dword [rbp + 0x24]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x180061858]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x180061858]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x20]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1800d0410]
lea ecx, [rax + rax*4]
add ecx, ecx
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180052c8e
lea rcx, [rbp - 0x50]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.18004c8fc
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180053538
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d1380]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800536a7
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1800536a7
mov eax, dword [0x1800d13bc]
mov rdx, qword [rax + rcx]
test rdx, rdx
je 0x1800536a7
cmp qword [rcx + 0x30], 0
je 0x1800536a7
mov rax, qword [0x1800d1388]
mov r8, qword [rax]
test r8, r8
je 0x1800536a7
cmp qword [r8 + 0x10], 0
je 0x1800536a7
cmp byte [0x1800d5718], 0
je 0x1800535cf
cmp byte [0x1800d13e9], 0
movss xmm0, dword [0x1800d06d0]
je 0x1800535c7
movss dword [rdx + 0xd40], xmm0
jmp 0x1800535cf
movss dword [rdx + 0xcf0], xmm0
mov eax, dword [0x1800d13e0]
cmp byte [rax + rcx], 0x40
je 0x1800536a7
movss xmm0, dword [0x18005b868]
comiss xmm0, dword [rcx + 0x280]
ja 0x1800536a7
mov rax, qword [0x1800d5ea0]
test rax, rax
jne 0x180053699
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18005367e
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x18005367e
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x18005367a
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x18005365d
cmp ebx, 0x95466b05
je 0x1800536b7
test ecx, ecx
jne 0x18005363f
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x180053690
cmp qword [rax + 0x30], 0
jne 0x18005361b
xor eax, eax
mov qword [0x1800d5ea0], rax
mov ecx, 0xa0
call rax
mov byte [0x1800d573c], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180053692
Function at 0x1800561b8
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800d0780]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x180056118]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x18005622f
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x180056118]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180047e0c
mov rcx, rax
call fcn.180048078
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800561fc
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180056830
add rsp, 0xd8
ret

Function at 0x180056270
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
lea r8, [0x1800562a8]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
je 0x1800562a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
Function at 0x142414058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1424141df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142414089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14241406f
add dl, dl
jne 0x142414096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424140f6
xor eax, eax
add dl, dl
jne 0x1424140a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424141ad
add dl, dl
jne 0x1424140b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424140c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424140d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424140dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1424140ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14241407e
mov eax, 1
add dl, dl
jne 0x142414106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142414113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1424140fb
sub eax, ebx
mov ebx, 1
jne 0x14241414c
mov ecx, 1
add dl, dl
jne 0x14241412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14241413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142414123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14241407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142414168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142414175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14241415d
cmp eax, 0x7d00
jae 0x14241419b
cmp eax, 0x500
jb 0x142414196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14241407e
cmp eax, 0x7f
ja 0x14241419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14241407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1424141d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14241407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140028974
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c284
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c284
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028ac4
cmp rax, 0xffffffffffffffff
je 0x140028ac4
xor edi, edi
test rbp, rbp
jle 0x140028a6f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb98
mov rbx, rax
test rax, rax
jne 0x1400289fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028a65
mov edx, 0x8000
mov ecx, r14d
call fcn.140019be8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cf60
cmp eax, 0xffffffff
je 0x140028a45
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a0c
mov edx, r15d
mov ecx, r14d
call fcn.140019be8
jmp 0x140028a65
cmp byte [rsi + 0x38], dil
je 0x140028a5c
cmp dword [rsi + 0x34], 5
jne 0x140028a5c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028a65
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a948
jmp 0x140028ad8
jns 0x140028ad8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c284
cmp rax, 0xffffffffffffffff
jne 0x140028a90
cmp byte [rsi + 0x30], dil
je 0x140028ad8
mov edi, dword [rsi + 0x2c]
jmp 0x140028ad8
mov ecx, r14d
call fcn.14001871c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028ad8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028ad1
mov eax, dword [rsi + 0x2c]
jmp 0x140028ad6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c284
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001120
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, 0x18
syscall
ret
Function at 0x14017e1d6
Capabilities:
Create thread

Disassembly:
jmp 0x14041c110
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x14058cc40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1405c70ac]
call fcn.1401879a7
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140187d44
mov r8, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1401809db
nop
lea rax, [0x14018143f]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140184225
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14041c1f8
lea rcx, [rbp + 8]
call fcn.140184144
nop
jmp 0x14041c211
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1401801d4
nop
lea rcx, [rbp + 8]
call fcn.1401844c3
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14053ab90]
call fcn.140185e45
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.140182a60
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x14017ed98
Capabilities:
Write file on windows

Disassembly:
jmp 0x1403aac60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1405c654f]
call fcn.1401879a7
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1403aacb8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1403aadca
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1403aad63
cmp qword [rbp + 0x28], 0
jle 0x1403aad63
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1403aad01
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140186f93
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x1403aadb9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1403aadb9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14017f9aa
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140304790
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405c636f]
call fcn.1401879a7
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1403047ce
mov rcx, qword [rbp + 0x100]
call fcn.14017fe0f
nop
jmp 0x1403047ea
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1403047ea
mov rcx, qword [rbp + 0x100]
call fcn.140182b87
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14017fa36
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1403084b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405c630e]
call fcn.1401879a7
nop
mov qword [rbp + 8], 0
jmp 0x1403084ef
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x140308545
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1403084e4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140181fed
Capabilities:
Get disk information

Disassembly:
jmp 0x1403ed9a0
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14058cc40]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1405c6cbd]
call fcn.1401879a7
nop
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rbp + 4], eax
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
jmp 0x1403ed9ff
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x1a
jge 0x1403eda97
mov eax, dword [rbp + 0x44]
mov ecx, 1
mov dword [rbp + 0x154], ecx
movzx ecx, al
mov eax, dword [rbp + 0x154]
shl eax, cl
mov ecx, dword [rbp + 4]
and ecx, eax
mov eax, ecx
test eax, eax
jne 0x1403eda2f
jmp 0x1403ed9f7
mov eax, dword [rbp + 0x44]
add eax, 0x41
mov byte [rbp + 0x64], al
mov byte [rbp + 0x65], 0x3a
mov byte [rbp + 0x66], 0x5c
mov byte [rbp + 0x67], 0
lea rcx, [rbp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 2
je 0x1403eda6f
cmp dword [rbp + 0x84], 3
je 0x1403eda6f
cmp dword [rbp + 0x84], 4
jne 0x1403eda92
mov eax, dword [rbp + 0x44]
mov ecx, 1
mov dword [rbp + 0x154], ecx
movzx ecx, al
mov eax, dword [rbp + 0x154]
shl eax, cl
mov ecx, dword [rbp + 0x24]
or ecx, eax
mov eax, ecx
mov dword [rbp + 0x24], eax
jmp 0x1403ed9f7
mov eax, dword [rbp + 0x24]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1404fdd10]
call fcn.140185e45
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.140182a60
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140182b87
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14030ce80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405c636f]
call fcn.1401879a7
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x14030cec5
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x14030cf56
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x14030cf1b
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14030cf25
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14030ceba
mov qword [rbp + 0x88], 0xe3
jmp 0x14030cf74
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x14030d01d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x14030cfd9
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14030cfe3
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14030cf63
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x14030d07d
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x14030d087
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x140183636
Capabilities:
Terminate process

Disassembly:
jmp 0x14042b660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140183fd2
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1403c1a70
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x708]
mov rax, qword [0x14058cc40]
xor rax, rbp
mov qword [rbp + 0x6b8], rax
lea rcx, [0x1405c6b4e]
call fcn.1401879a7
nop
mov qword [rbp + 8], 0xffffffffffffffff
mov edx, dword [rbp + 0x6e0]
mov ecx, 8
call fcn.140182934
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1403c1ae2
xor al, al
jmp 0x1403c1b69
mov dword [rbp + 0x30], 0x438
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140183f37
test eax, eax
jne 0x1403c1b1d
lea rdx, str.Module32First_was_unsucessful__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14017ef91
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x1403c1b69
lea rdx, str.jvm.dll
lea rcx, [rbp + 0x60]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
je 0x1403c1b47
lea rdx, str.javaw.exe
lea rcx, [rbp + 0x60]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1403c1b4b
mov al, 1
jmp 0x1403c1b69
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14017f68a
test eax, eax
jne 0x1403c1b1d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1404fa7e0]
call fcn.140185e45
mov rax, rdi
mov rcx, qword [rbp + 0x6b8]
xor rcx, rbp
call fcn.140182a60
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret