joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc900
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm2, xmmword [0x140171400]
mov r10, rcx
movdqa xmm3, xmmword [0x1401713b0]
mov rax, rcx
movdqa xmm4, xmmword [0x140171420]
mov r11, r8
movdqa xmm5, xmmword [0x140171340]
lea r8, [rcx + 0x1c00]
movdqu xmm0, xmmword [r9]
lea rcx, [rdx - 0x1c00]
movdqu xmm1, xmmword [r9 + 0x10]
add rcx, rax
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1401713d0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1401712a0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1401712e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140171300]
nop
cmp rax, rcx
jae 0x1400bca53
nop dword [rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x10], xmm1
aesdec xmm6, xmm10
movdqu xmmword [rax + 0x20], xmm6
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x30], xmm7
aesdec xmm0, xmm8
movdqu xmmword [rax + 0x40], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x50], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r8]
prefetcht0 byte [r8 + 0x40]
sub rax, 0xffffffffffffff80
lea r8, [r8 + 0x80]
cmp rax, rcx
jb 0x1400bc9b0
add rcx, 0x1c00
mov r8, r10
sub rdx, 1
jne 0x1400bc9a0
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x140171270]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x140171430]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r11], xmm2
movdqu xmmword [r11 + 0x10], xmm3
movdqu xmmword [r11 + 0x20], xmm4
movdqu xmmword [r11 + 0x30], xmm5
add rsp, 0x68
ret
Function at 0x1400c5770
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400c586e
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1400c5855
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.140118cd0
movaps xmm0, xmmword [0x140169c00]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140169c10]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140169c20]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140169c30]
xorps xmm0, xmm0
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
movq rax, xmm0
xor qword [rbx + 0x20], rax
xor qword [rbx + 8], 0
psrldq xmm0, 8
movq rax, xmm0
xor qword [rbx + 0x28], rax
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1400c5873
cmp byte [rcx + 0xe8], 0
je 0x1400c5866
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140116030
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x1400c9990
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x14018b8d8]
movdqa xmm4, xmmword [0x1401713d0]
add rcx, rax
movdqa xmm5, xmmword [0x1401712a0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1401712e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x140171300]
cmp rax, rcx
jae 0x1400c9a20
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x1400c99f0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x1400d0e90
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1400d0ec3
cmp r8, rdx
jb 0x1400d0ec3
sub rdx, rcx
mov r8d, 0x80
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1400d0eb1
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, select
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1400d0ed0
ret
Function at 0x1400e0620
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor edi, edi
lea rcx, [0x14018e130]
call fcn.1400f1e90
mov eax, 2
xchg dword [0x14018e0e8], eax
cmp eax, 1
je 0x1400e066a
lea rcx, [0x14018e130]
call fcn.1400f1e60
xor eax, eax
jmp 0x1400e0754
xor r9d, r9d
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x30], rdi
lea rcx, str.conout_
mov qword [rsp + 0xa0], rbp
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 3]
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e06d2
lea rdx, [0x14018e0f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400e06d2
lock or dword [0x14018e0ec], 1
mov r14d, 1
mov dword [rsp + 0x50], 0xd0001
mov ebp, 0xd
mov word [rsp + 0x48], r14w
mov ecx, ebp
mov dword [rsp + 0x4c], r14d
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rsi + 0x110]
lea r9, [rsp + 0x40]
mov r8d, r14d
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], bp
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1400e073b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x1400e074a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x98]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140116030
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1400e1100
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb8]
mov r15d, r9d
movzx r14d, r8b
mov ebp, edx
mov rbx, rcx
cmp dword [rdi], 0
je 0x1400e113e
mov eax, 0xffffffff
jmp 0x1400e11c0
mov qword [rsp + 0x58], rsi
movzx esi, byte [rsp + 0xb0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1400e116e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov byte [rsp + 0x28], sil
lea rdx, [rsp + 0x30]
movzx r9d, r14b
mov dword [rsp + 0x20], r15d
mov r8d, ebp
mov rcx, rbx
call fcn.1400e1060
mov rcx, qword [rbx + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1400e11b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400e1150
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x1400e11bb
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140116030
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400e1500
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 0xc
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x1400e1548
test cl, 1
jne 0x1400e1548
test cl, 4
je 0x1400e1548
and eax, 0xfffffffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1400e1548
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
bt eax, 0x10
jae 0x1400e15bd
bt eax, 0x19
jae 0x1400e15a4
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov eax, select
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x28], ax
lea r8d, [rax - 0xf]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1400e15bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140116030
add rsp, 0x50
pop rbx
ret
bt eax, 0x15
jb 0x1400e15bd
mov rcx, rbx
call fcn.1400e0620
test eax, eax
jne 0x1400e15bf
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140116030
add rsp, 0x50
pop rbx
ret
Function at 0x1400e15e0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x1400e1632
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x1400e163c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
jmp 0x1400e16ee
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x1400e16d9
nop
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1400e16d9
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x1400e16ce
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1400e170c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1400e1660
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140116030
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x38]
mov dword [0x14018a020], r14d
call fcn.1400e1de0
mov rcx, qword [rdi + 0x110]
lea rdx, [0x14018e140]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
test eax, eax
je 0x1400e16d9
xor eax, eax
jmp 0x1400e16e6
Function at 0x1400e38d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
xor r9d, r9d
mov r11d, edx
mov rdi, rcx
mov r10d, r9d
mov ebx, r9d
cmp edx, 2
jb 0x1400df3b1
lea eax, [rdx - 2]
mov qword [rsp + 0x10], rsi
shr eax, 1
mov r8, rcx
inc eax
mov edx, eax
lea esi, [rax + rax]
lea rcx, [rax + rax]
mov eax, dword [r8]
lea r8, [r8 + 0x20]
add r9, rax
mov eax, dword [r8 - 0x10]
add r10, rax
sub rdx, 1
jne 0x1400df382
cmp esi, r11d
mov rsi, qword [rsp + 0x10]
jb 0x1400df3c0
lea rax, [r10 + r9]
add rax, rbx
mov rbx, qword [rsp + 0x18]
pop rdi
ret
test r11d, r11d
je 0x1400df3c6
mov rcx, r9
nop dword [rax]
add rcx, rcx
mov ebx, dword [rdi + rcx*8]
lea rax, [r10 + r9]
add rax, rbx
mov rbx, qword [rsp + 0x18]
pop rdi
ret
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x100], 0
mov ebx, r8d
mov rdi, rdx
jbe 0x1400e1da9
mov eax, 0xfffff008
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r9, [rsp + 0x30]
call fcn.1400e1e40
test eax, eax
je 0x1400e1dca
mov ecx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400f0f30
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400df350
mov eax, dword [rcx + 0x58]
test al, 1
je 0x1400e38dd
mov eax, 0xfffff00d
ret
bt eax, 0xf
jb 0x1400e38e9
mov eax, 0xfffff031
ret
mov eax, dword [rcx + 0x10]
cmp eax, 7
je 0x1400e390b
cmp eax, 0xc
je 0x1400e3906
cmp eax, 0xe
je 0x1400e3901
mov eax, 0xfffff02a
ret
jmp 0x1400e1d80
jmp 0x1400ec770
mov eax, 0xfffff008
ret
sub rsp, 0x48
cmp dword [rcx + 0x100], 0
jbe 0x1400ec787
mov eax, 0xfffff008
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1400ec7c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400f0f30
add rsp, 0x48
ret
mov eax, dword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1400e5480
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov eax, dword [rcx + 0x150]
mov dword [rsp + 0x90], eax
mov eax, dword [rdx]
and al, 3
cmp al, 1
jne 0x1400e54e2
mov dword [rcx + 0x14c], 0x3ec
mov ecx, 0x3ec
call fcn.1400f0f30
movsxd rdx, eax
mov qword [rdi + 0x88], rdx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rdx + 4], 0
je 0x1400e5516
mov dword [rcx + 0x14c], 1
mov ecx, 1
call fcn.1400f0f30
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x180]
cmp rcx, 0xffffffffffffffff
jne 0x1400e5527
mov rcx, qword [rdx + 0x18]
mov r12, qword [rdx + 0x10]
xor r13d, r13d
cmp rcx, r12
jge 0x1400e56c5
mov r8d, r13d
mov eax, dword [rdi + 0x170]
test eax, eax
je 0x1400e555f
mov rdx, qword [rdi + 0x178]
mov r9d, eax
nop
mov eax, dword [rdx]
add r8, rax
lea rdx, [rdx + 0x10]
sub r9, 1
jne 0x1400e5550
sub r12, rcx
cmp r8, r12
cmovl r12, r8
test r12, r12
je 0x1400e56c5
lea rbx, [r12 + rcx]
mov r8d, dword [0x14018e178]
mov rax, rcx
cqo
idiv r8
mov rax, rdx
mov qword [rsp + 0x38], rdx
sub rcx, rdx
add rax, r12
mov r8, rcx
shr r8, 0x20
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov edx, 4
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x1400e55ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400f0f30
movsxd rcx, eax
mov qword [rdi + 0x88], rcx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, r13
mov r15d, r13d
cmp r15d, dword [rdi + 0x170]
jae 0x1400e567b
cmp rsi, r12
jae 0x1400e567b
mov ecx, r15d
shl rcx, 4
add rcx, qword [rdi + 0x178]
mov r14d, dword [rcx]
mov rax, r12
sub rax, rsi
cmp r14, rax
cmovae r14, rax
mov dword [rsp + 0x30], r13d
add rdx, rsi
add rdx, qword [rsp + 0x38]
mov r8, r14
mov rcx, qword [rcx + 8]
call fcn.140118430
nop
add rsi, r14
inc r15d
mov rdx, qword [rsp + 0x98]
jmp 0x1400e55f4
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x1400e55c1
cmp qword [rdi + 0x180], 0xffffffffffffffff
jne 0x1400e56ae
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x18], rbx
mov ecx, dword [rsp + 0x90]
call fcn.1400e74e0
mov qword [rdi + 0x88], r12
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rdi + 0x88], r13
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e7800
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x14018e150]
mov dword [0x14018e178], eax
call fcn.1400f1db0
test eax, eax
jne 0x1400e785d
lea rax, [0x140416188]
mov edx, 0x100
lea rcx, [0x14018e180]
xor r8d, r8d
nop
mov qword [rax], rcx
add rcx, 0x2880
mov qword [rax - 8], r8
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1400e7840
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.1400f0e80
int3
Function at 0x1400e93c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x20
mov r12, r8
mov r14, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1400e93fa
xor ebp, ebp
test rdx, rdx
je 0x1400e93e6
mov qword [rdx], rbp
mov qword [r8], rbp
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400e9410
mov rbx, rdi
nop dword [rax]
test rbx, rbx
je 0x1400e9439
movzx eax, word [rcx + rbx*2 - 2]
dec rbx
cmp ax, 0x5c
je 0x1400e9439
cmp ax, 0x2f
jne 0x1400e9420
mov qword [rsp + 0x50], r15
test rbx, rbx
jne 0x1400e949f
test r14, r14
je 0x1400e9491
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x1400e948a
mov ecx, ebx
add rcx, rcx
call fcn.1400df590
mov qword [r14], rax
test rax, rax
je 0x1400e9527
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400e9491
mov rcx, qword [r14]
call fcn.1400df3e0
xor ebp, ebp
mov qword [r14], rbp
mov eax, 0xffffffff
jmp 0x1400e9509
mov rcx, rsi
call fcn.140132f4c
mov qword [r12], rax
jmp 0x1400e9507
xor ebp, ebp
lea r15, [rbx + rbx]
test r14, r14
je 0x1400e94d3
lea rcx, [r15 + 4]
call fcn.1400df590
mov qword [r14], rax
test rax, rax
je 0x1400e9527
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140129c10
mov rax, qword [r14]
mov word [rax + r15 + 2], bp
sub rdi, rbx
lea rbx, [rdi + rdi]
mov rcx, rbx
call fcn.1400df590
mov qword [r12], rax
test rax, rax
je 0x1400e9527
lea rdx, [rsi + 2]
mov rcx, rax
add rdx, r15
lea r8, [rdi - 1]
call fcn.140129c10
mov rax, qword [r12]
mov word [rbx + rax - 2], bp
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
lea rdx, str.uv__malloc
mov ecx, select
call fcn.1400f0e80
int3
Function at 0x1400e9c30
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14018a240]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400e9c5d
mov eax, 0xfffff019
jmp 0x1400e9e12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x28]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400e9c8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f0f30
jmp 0x1400e9e12
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x250], r14
xor edx, edx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400e9cd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.1400f0f30
jmp 0x1400e9e0a
mov ecx, dword [rsp + 0x20]
add rcx, rcx
mov qword [rsp + 0x258], rdi
call fcn.1400df590
mov rcx, qword [rsp + 0x28]
mov rdi, rax
test rax, rax
jne 0x1400e9d09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff027
jmp 0x1400e9e02
lea r8, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x1400e9d42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1400df3e0
mov ecx, ebx
call fcn.1400f0f30
jmp 0x1400e9e02
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1400e9d85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.1400df3e0
cmp ebx, 0x7a
jne 0x1400e9d36
mov eax, 0xfffff027
jmp 0x1400e9e02
mov qword [rsp + 0x278], rbp
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov qword [rsp + 0x280], rsi
mov rcx, rdi
mov qword [rbx + 0x18], r14
call fcn.1400e9a60
mov rcx, rdi
mov ebp, eax
call fcn.1400df3e0
test ebp, ebp
je 0x1400e9dbc
mov eax, ebp
jmp 0x1400e9df2
mov r8, rbx
mov qword [rbx], r14
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.1400e9a60
mov edi, eax
test eax, eax
je 0x1400e9de4
mov rcx, qword [rbx + 0x18]
call fcn.1400df3e0
mov eax, edi
jmp 0x1400e9df2
mov qword [rbx + 0x10], r14
xor eax, eax
mov qword [rbx + 8], 0xffffffffffffffff
mov rsi, qword [rsp + 0x280]
mov rbp, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140116030
add rsp, 0x260
pop rbx
ret

Function at 0x1400e9ee0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1400e9efc
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400e9efc
mov eax, 0xfffff01a
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret