joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c20
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x140003c7a
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
ror byte [rcx + rdx*4 + 0xc], cl
cmp r15, 0
je 0x140003c82
mov r14, qword [r14]
jmp 0x140003c4b
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
invalid
invalid
out dx, al
invalid

Function at 0x140004198
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400041e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400041e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400041e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400041e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400041e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400041e4
xor al, al
add rsp, 0x28
ret

Function at 0x14000b2dc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000b0d8

Function at 0x14000dfa0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000dfd0
xor eax, eax
jmp 0x14000e093
mov rbp, rbx
cmp word [rax], si
je 0x14000dff5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000dfdc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000dfd8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000dec0
movsxd r14, eax
test eax, eax
jne 0x14000e033
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000dfc9
mov rcx, r14
call fcn.14000ee7c
mov rdi, rax
test rax, rax
jne 0x14000e04c
xor ecx, ecx
call fcn.14000c520
jmp 0x14000e028
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000dec0
test eax, eax
jne 0x14000e07d
mov rcx, rdi
call fcn.14000c520
jmp 0x14000e087
xor ecx, ecx
call fcn.14000c520
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140011510
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000cf90
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001159a
cmp byte [rbp - 0x21], r15b
je 0x140011595
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400115d0
call fcn.14000f68c
test eax, eax
jne 0x1400115bc
cmp byte [rbp - 0x21], r15b
je 0x1400115b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400115d0
cmp byte [rbp - 0x21], r15b
je 0x1400115cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c570
test eax, eax
jne 0x140011670
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000cf90
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001160f
cmp byte [rbp - 0x21], r15b
je 0x140011644
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140011644
call fcn.14000f68c
test eax, eax
jne 0x140011630
cmp byte [rbp - 0x21], r15b
je 0x140011629
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140011644
cmp byte [rbp - 0x21], r15b
je 0x140011641
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c570
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140011670
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140011673
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140011681
mov rcx, rdi
call fcn.14000c520
cmp byte [rbp + 0x3f], r15b
je 0x140011690
mov rcx, qword [rbp + 0x27]
call fcn.14000c520
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400136d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140021040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x140022d40]
xor r11d, r11d
lea rdi, [0x14001d9a0]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x140013748
mov rax, 0xfffffffffffffffe
jmp 0x140013895
cmp word [r10 + 6], r11w
jne 0x1400137b7
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x140013772
test r14, r14
je 0x140013763
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x140013895
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x140013780
mov r8b, 2
jmp 0x14001379e
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x14001378e
mov r8b, 3
jmp 0x14001379e
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x14001388a
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x1400137e0
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x14001388a
cmp bl, bpl
jb 0x14001388a
cmp bl, r8b
jae 0x14001388a
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x14001380d
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x14001388a
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x1400137ef
cmp r9, rbp
jae 0x140013839
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x14001373c
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x14001388a
cmp edx, 0x110000
jae 0x14001388a
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x14001388a
test r14, r14
je 0x140013878
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.1400136bc
jmp 0x140013895
mov rdx, rsi
mov rcx, r10
call fcn.1400136c4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003c50
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140014540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140005de8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005e32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005e32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005e32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005e32
cmp dword [rcx + 0x84], 0xe
jbe 0x140005e32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005e34
xor al, al
add rsp, 0x28
ret
Function at 0x140015490
Capabilities:
Hash data with crc32

Disassembly:
xchg rsi, rcx
mov qword [rsp + 0x10], rcx
xchg rsi, rcx
nop
jmp 0x140015519
cmp r8d, 1
jae 0x1400155b0
mov eax, r8d
mov qword [rsp + 0x30], rbx
jmp 0x14001552e
xchg rsp, rsp
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x18], esi
jmp 0x14001556b
neg rsp
xchg rsi, rcx
mov rcx, rdx
xchg rcx, rsi
mov edi, ecx
mov rsi, rsi
jmp 0x1400154a1
mov rcx, rcx
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
xchg rsi, rdx
mov rdx, qword [rsp + 0x38]
jmp 0x140015586
sub edx, 0x2ea0abdd
add edx, 0x2e44831d
xor edx, 0xcfadfcc
xor edx, 0x4779c094
jmp 0x140015557
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
jmp 0x1400154cb
mov dword [rsp - 0x2c], ecx
lea ebx, [r8 + 1]
movsx r9d, byte [rax + rdx]
mov edx, 0x2a210772
xor edx, 0x6bc45a5f
xor edx, 0x56bc5998
add edx, 0x26f68cd3
jmp 0x1400154fc
sub edx, 0x7670778f
xor r9d, ecx
movzx eax, r9b
mov ecx, eax
jmp 0x1400154b8
and ecx, 0xedb88320
xor ecx, eax
call fcn.140015cd0
shr edi, 5
shr edi, 1
shr edi, 1
shr edi, 1
jmp 0x140015597
xchg rdx, rsi
add rsp, 0x20
pop rdi
mov dword [rsp - 0x3c], esi
jmp fcn.140015490
mov r8d, ebx
xor eax, edi
mov dword [rsp - 0x14], ebp
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
mov ecx, eax
jmp 0x1400154e1
mov rsi, qword [rsp + 0x38]
mov eax, edi
mov r15, r15
nop
sub rsp, 0x3e83e403
add rsp, 0x3e83e423
nop
jmp 0x1400155cf
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14008cc30
Capabilities:
Enumerate processes

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg r13, rbx
push rsi
mov dword [rsp - 0x34], 0x546280cb
jmp 0x14008cd87
xor rax, 0x25e32c1
add rax, 0x14a12fdf
sub rax, 0x3fcf9432
add rax, 0x7fffffff
add rax, 0x7b21b870
jmp 0x14008cc9e
xor edi, edi
xchg r15, r15
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14008ce77
jmp 0x14008cda4
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
mov r8, qword [rbx + 0x10]
mov r9, r9
jb 0x14008cd10
jmp 0x14008cd07
nop dword [rax]
inc rax
mov dword [rsp - 0x38], 0x535ca0fb
cmp byte [rcx + rax], 0
jne 0x14008cca2
cmp qword [rbx + 0x18], 0x10
mov dword [rsp - 0x44], esp
jmp 0x14008cc83
xor dword [rsp + 0x20], 0x573985a3
sub dword [rsp + 0x20], 0x471221d7
xor dword [rsp + 0x20], 0x2cfca6d9
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
jmp 0x14008cc6c
sub cl, 0x40
jmp 0x14008ce61
call fcn.1400ec510
test eax, eax
jne 0x14008ce5f
mov cl, 0x48
jmp 0x14008cd4f
xchg rdx, rcx
mov rdx, qword [rbx]
xchg rdx, rcx
cmp r8, rax
jne 0x14008ce5f
lea rdx, [rsp + 0x4c]
mov r13, r13
jmp 0x14008ccf3
mov r13, r13
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
xchg r9, r9
jmp 0x14008cdf5
xchg rbx, rdi
mov rdi, rdx
xchg rbx, rdi
xor edx, edx
lea ecx, [rdx + 2]
jmp 0x14008cd26
xor cl, 0x18
sub cl, 2
sub cl, 0x17
jmp 0x14008ce3a
xor r8d, 0x47a6e42d
sub r8d, 0x72af8bbc
lea rcx, [rsp + 0x24]
call fcn.1400ebfc0
mov dword [rsp - 0x38], 0x38fc3425
lea rdx, [rsp + 0x20]
jmp 0x14008ce05
neg rsp
sub rsp, 0xfffffffffffffea0
neg rsp
mov rax, qword [0x1402567f0]
mov dword [rsp - 0x20], esi
jmp 0x14008ce4b
mov dword [rsp - 0x14], 0x66479c7
nop dword [rax]
lea rcx, [rsp + 0x4c]
nop
movabs rax, 0xffffffff06330fab
add rax, 0x2c1f8977
jmp 0x14008cc49
mov qword [rsp + 0x170], rbx
xchg rbx, rdi
mov r8d, 0x5a51f472
xor r8d, 0x1ff5cd17
xor r8d, 0x3e439a54
sub r8d, 0x46de3a6c
jmp 0x14008cd5d
je 0x14008cebe
xor edx, edx
xchg rbx, rdi
jmp 0x14008cdca
mov dword [rsp + 0x20], 0x1e16bd43
add dword [rsp + 0x20], 0x3b8eaba1
xor dword [rsp + 0x20], 0x2f0e2073
xor dword [rsp + 0x20], 0x77beb3a6
add dword [rsp + 0x20], 0x6b85f1b6
sub dword [rsp + 0x20], 0x4964a084
jmp 0x14008ccc5
add cl, 0x25
xor cl, 0x14
sub cl, 0x31
add cl, 0x2a
jmp 0x14008cceb
xor rax, rsp
xchg r8, rax
mov qword [rsp + 0x150], r8
xchg r8, rax
jmp 0x14008cd3c
xor cl, cl
test cl, cl
lea eax, [rdi + 1]
jmp 0x14008ce8f
test eax, eax
jne 0x14008cdaf
mov dword [rsp - 0x20], edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x170]
jmp 0x14008ceba
mov dword [rsp - 0x28], ebp
lea rdx, [rsp + 0x20]
xchg rdx, rsi
mov rcx, rdx
xchg rdx, rsi
jmp 0x14008cea7
ret
cmove eax, edi
mov dword [rsp - 0x24], esi
mov edi, eax
call sub.KERNEL32.dll_Process32Next
jmp 0x14008ce6b
mov dword [rsp - 0x24], edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e9870
mov dword [rsp - 0x1c], esp
mov rbx, qword [rsp + 0x178]
jmp 0x14008cedf
sub rsp, 0x7bebe0a7
add rsp, 0x7bebe207
pop rsi
mov dword [rsp - 0x20], edx
jmp 0x14008cea6
Function at 0x1400a6ec0
Capabilities:
Create thread

Disassembly:
push rbx
mov dword [rsp - 0x20], 0x733fa332
nop
sub rsp, 0x7f99ad11
add rsp, 0x7f99acc1
mov rax, qword [0x1402567f0]
mov r10, r10
jmp 0x1400a6f91
movaps xmm0, xmmword [rsp + 0x30]
xchg rbx, rsi
movups xmmword [rsi + 0x1b0], xmm0
xchg rsi, rbx
jmp 0x1400a6f42
mov qword [rsp + 0x28], r9
xchg r9, rcx
mov dword [rsp + 0x20], 0x2370973d
add dword [rsp + 0x20], 0x148ba365
xor dword [rsp + 0x20], 0x467c2353
sub dword [rsp + 0x20], 0x287fda5c
jmp 0x1400a6fb2
xorps xmm0, xmm0
xchg r8, rbx
movups xmmword [r8 + 0x1b0], xmm0
xchg r8, rbx
jmp 0x1400a6f61
cmp dword [rbx + 0x1b8], 0
je 0x1400a7169
mov rdx, rdx
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
jmp 0x1400a6f7b
mov rcx, qword [rsp + 0x48]
mov rbp, rbp
xor rcx, rsp
call fcn.1400e9870
sub rsp, 0xffffffffffffffb0
pop rbx
jmp 0x1400a6ff4
call fcn.1400e8a14
test eax, eax
mov dword [rsp - 0x1c], ebx
jne 0x1400a70e8
jmp 0x1400a6f2c
xor rax, rsp
mov qword [rsp + 0x48], rax
xchg rbx, r9
mov r9, rcx
xchg r9, rbx
mov ecx, 0x170486a7
sub ecx, 0xa9d952b
jmp 0x1400a706e
sub dword [rsp + 0x20], 0x13229a17
xor dword [rsp + 0x20], 0x35dda57e
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [0x1400a5d40]
xor edx, edx
jmp 0x1400a705a
sub ecx, 0x1b16c7ad
call fcn.1400e9714
test rax, rax
mov dword [rsp - 0x14], ebp
je 0x1400a703c
jmp 0x1400a6ff8
mov r12, r12
ret
mov qword [rax], rbx
lea rcx, [0x1400a61a0]
xchg rcx, r8
mov qword [rax + 8], r8
jmp 0x1400a7039
mov qword [rsp + 0x30], rax
test rax, rax
xchg r10, r10
je 0x1400a7095
cmp dword [rbx + 0x1b8], 0
jne 0x1400a708b
mov dword [rsp - 0x18], 0x248ba2e7
jmp 0x1400a6ee8
xchg rcx, r8
xchg rdi, rax
mov qword [rsp + 0x40], rdi
xchg rdi, rax
lea rcx, [rsp + 0x38]
mov dword [rsp - 0x2c], 0x1d2cc9b8
xchg r9, rcx
jmp 0x1400a6eff
xor ecx, ecx
mov dword [rsp - 0x34], 0x3ea63b31
call fcn.1400f7128
jmp 0x1400a700e
xor ecx, 0x7e05b4d3
sub ecx, 0x2cb5d22b
add ecx, 0x10962936
sub ecx, 0x3b2cd4fd
jmp 0x1400a6fd7
call fcn.1400f6b88
mov dword [rsp - 0x30], ecx
nop
mov dword [rsp + 0x38], 0x2f17c51
jmp 0x1400a70a2
add dword [rsp + 0x38], 0x7d0af9af
sub dword [rsp + 0x38], 0x4c9f4fff
add dword [rsp + 0x38], 0x4b020dd1
xor dword [rsp + 0x38], 0x5547c18f
jmp 0x1400a7138
add ecx, 0x42344218
sub ecx, 0x24839c05
xor ecx, 0x264beadb
jmp 0x1400a70de
call fcn.1400e8db0
mov dword [rsp - 0x30], edi
int3
mov ecx, eax
call fcn.1400e8d74
xchg rsi, rsi
int3
xor ecx, 0x348f0884
xor ecx, 0x33a451b0
xor ecx, 0x27496268
jmp 0x1400a70c7
mov ecx, 0x73219c46
sub ecx, 0x2497875d
xor ecx, 0x6147df54
xor ecx, 0x94aa3e0
add ecx, 0x145d83e5
sub ecx, 0x364f6438
add ecx, 0x4d0cf0fd
jmp 0x1400a715d
add dword [rsp + 0x38], 0x5252be13
sub dword [rsp + 0x38], 0x75701223
add dword [rsp + 0x38], 0x51899a33
sub dword [rsp + 0x38], 0x59853880
jmp 0x1400a710a
xor ecx, 0x51a27901
call fcn.1400e8db0
nop
mov ecx, 0x420e753f
sub ecx, 0x71a7d66
xor ecx, 0x120a8842
jmp 0x1400a70f3
Function at 0x1400ae8d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r9b, reloc.WS2_32.dll_select
test r8d, r8d
je 0x1400ae8f4
nop word [rax + rax]
xor byte [rdx], r9b
lea ecx, [rax + 0xb]
add r9b, cl
lea rdx, [rdx + 1]
inc eax
cmp eax, r8d
jb 0x1400ae8e0
ret

Function at 0x1400af020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
jb 0x1400af02e
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x1400af780
Capabilities:
Modify service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x1400af83f
mov r8d, 0xf003f
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x1400af83f
mov qword [rsp + 0x90], rbp
lea r8, [rsp + 0x60]
mov ebp, 1
mov rcx, rax
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
lea r8d, [rbp + 3]
mov qword [rsp + 0x50], rax
mov edx, 0xffffffff
mov qword [rsp + 0x48], rax
mov r9d, edx
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, ebp
movzx edi, dil
cmove edi, ebp
mov rbp, qword [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x80]
movzx eax, dil
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400aff40
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movsx ebx, cl
lea rcx, [rax + 8]
mov byte [rax + 8], bl
mov word [rax + 9], 0x5c3a
mov byte [rax + 0xb], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.0x1400aff81.0
lea rcx, [0x140000000]
mov eax, eax
mov edx, dword [rcx + rax*4 + 0xb0090]
add rdx, rcx
jmp rdx
mov eax, 3
add rsp, 0x90
pop rbx
ret
mov eax, dword [0x14011e7b0]
lea rcx, [rsp + 0x50]
movsd xmm0, qword [str..X:]
xor r9d, r9d
mov dword [rsp + 0x58], eax
xor edx, edx
movzx eax, word [0x14011e7b4]
mov qword [rsp + 0xb0], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
movsd qword [rsp + 0x50], xmm0
lea r8d, [rdi + 3]
mov word [rsp + 0x5c], ax
mov word [rsp + 0x58], bx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rdi
lea r9d, [rdi + 0xc]
mov rbx, rax
mov qword [rsp + 0x44], rdi
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x28
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov rcx, rbx
cmovne edi, dword [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 7
mov rdi, qword [rsp + 0xb0]
je case.0x1400aff81.2
mov eax, 2
add rsp, 0x90
pop rbx
ret
mov eax, 1
add rsp, 0x90
pop rbx
ret
mov eax, 4
add rsp, 0x90
pop rbx
ret
mov eax, 5
add rsp, 0x90
pop rbx
ret
xor eax, eax
add rsp, 0x90
pop rbx
ret
Function at 0x1400bca90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x20
mov r11, rcx
movzx r10d, r8b
movabs rsi, 0x100000001b3
mov ebx, r9d
mov eax, r8d
movabs rbp, 0xcbf29ce484222325
xor r10, rbp
shr eax, 8
imul r10, rsi
movzx r9d, al
mov rdi, rdx
mov rdx, qword [r11 + 0x100e8]
xor r10, r9
imul r10, rsi
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor r10, rcx
mov eax, r8d
mov rcx, qword [r11 + 0x10110]
imul r10, rsi
shr rax, 0x18
xor r10, rax
imul r10, rsi
and rcx, r10
shl rcx, 4
add rcx, qword [r11 + 0x100f8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400bcc00
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400bcb45
cmp rax, rcx
je 0x1400bcc00
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400bcb32
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400bcc00
movzx ecx, byte [rsp + 0x49]
mov r11, qword [rax + 0x30]
mov r9, qword [rax + 0x20]
movzx r8d, bl
xor r8, rbp
imul r8, rsi
xor r8, rcx
movzx ecx, byte [rsp + 0x4a]
imul r8, rsi
xor r8, rcx
movzx ecx, byte [rsp + 0x4b]
imul r8, rsi
xor r8, rcx
imul r8, rsi
and r8, qword [rax + 0x48]
mov r10, r8
add r10, r10
mov rdx, qword [r11 + r10*8 + 8]
mov rcx, rdx
cmp rdx, r9
je 0x1400bcc00
mov rax, qword [r11 + r10*8]
cmp ebx, dword [rdx + 0x10]
je 0x1400bcbbe
nop dword [rax]
cmp rcx, rax
je 0x1400bcc00
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x1400bcbb0
test rcx, rcx
cmove rcx, r9
cmp rcx, r9
je 0x1400bcc00
add r8, r8
mov rax, qword [r11 + r8*8]
cmp ebx, dword [rdx + 0x10]
je 0x1400bcbf3
cmp rdx, rax
je 0x1400bcbf1
mov rdx, qword [rdx + 8]
cmp ebx, dword [rdx + 0x10]
jne 0x1400bcbd6
test rdx, rdx
cmove rdx, r9
add rdx, 0x18
jmp 0x1400bcc05
xor edx, edx
test rdx, rdx
cmove rdx, r9
add rdx, 0x18
jmp 0x1400bcc05
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1400206b0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400be080
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x50
mov rsi, rcx
movzx r10d, dl
movabs r11, 0x100000001b3
mov eax, edx
shr eax, 8
movabs rdi, 0xcbf29ce484222325
xor r10, rdi
mov rbx, r9
imul r10, r11
mov r9d, r8d
movzx r8d, al
mov eax, edx
xor r10, r8
shr eax, 0x10
mov r8, qword [rsi + 0x100e8]
imul r10, r11
movzx ecx, al
xor r10, rcx
mov eax, edx
mov rcx, qword [rsi + 0x10110]
imul r10, r11
shr rax, 0x18
xor r10, rax
imul r10, r11
and rcx, r10
shl rcx, 4
add rcx, qword [rsi + 0x100f8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400be1f7
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400be132
nop dword [rax]
cmp rax, rcx
je 0x1400be1f7
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400be120
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400be1f7
movzx ecx, byte [rsp + 0x71]
movzx r8d, r9b
xor r8, rdi
mov rdi, qword [rax + 0x30]
imul r8, r11
xor r8, rcx
movzx ecx, byte [rsp + 0x72]
imul r8, r11
xor r8, rcx
movzx ecx, byte [rsp + 0x73]
imul r8, r11
xor r8, rcx
imul r8, r11
mov r11, qword [rax + 0x20]
and r8, qword [rax + 0x48]
mov r10, r8
add r10, r10
mov rcx, qword [rdi + r10*8 + 8]
mov rdx, rcx
cmp rcx, r11
jne 0x1400be19e
add rax, 0x18
lea rdx, [rsp + 0x20]
mov rcx, rax
jmp 0x1400be219
mov r10, qword [rdi + r10*8]
cmp r9d, dword [rcx + 0x10]
je 0x1400be1b7
cmp rdx, r10
je 0x1400be190
mov rdx, qword [rdx + 8]
cmp r9d, dword [rdx + 0x10]
jne 0x1400be1a8
add rax, 0x18
test rdx, rdx
cmove rdx, r11
cmp rdx, r11
je 0x1400be194
add r8, r8
mov rax, qword [rdi + r8*8]
cmp r9d, dword [rcx + 0x10]
je 0x1400be1ee
cmp rcx, rax
je 0x1400be1ec
mov rcx, qword [rcx + 8]
cmp r9d, dword [rcx + 0x10]
jne 0x1400be1d4
test rcx, rcx
cmove rcx, r11
jmp 0x1400be226
xor ecx, ecx
test rcx, rcx
cmove rcx, r11
jmp 0x1400be226
lea rcx, [rsi + 0x100e0]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x20]
call fcn.1400b8340
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
add rcx, 0x18
lea r8, [rsp + 0x70]
call fcn.1400b80f0
mov rcx, qword [rax]
add rcx, 0x18
cmp rcx, rbx
je 0x1400be245
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jb 0x1400be240
mov rdx, qword [rbx]
call fcn.1400197b0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400206b0
mov r8d, dword [rsp + 0x70]
mov r9, rax
mov edx, dword [rsp + 0x68]
mov rcx, rsi
call fcn.1400bcc30
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret