joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025800
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14004e940]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000b020
mov rcx, qword [0x14004eef8]
lea rdx, [rsp + 0x28]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x14004ef00]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14004ef08]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x14004ef00], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.14000b020
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14002592d
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x38]
cvttss2si eax, dword [rax + 0x114]
mov dword [rsp + 0x38], ecx
mov rcx, qword [0x14004eef8]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14004eef8]
jne 0x140025989
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140025989
mov rcx, qword [0x14004eef8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140025989
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140025999
mov eax, 0xffffffff
jmp 0x14002599e
call fcn.14000b0d0
cmp dword [0x14004e13c], eax
je 0x1400259b1
mov dword [0x14004e13c], eax
call fcn.1400259e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003f0b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140025e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004e940]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140025e78
cmp al, 0x25
jne 0x140025e6d
cmp byte [rcx + 1], al
jne 0x140025e78
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140025e61
cmp byte [rcx], 0x25
jne 0x140025f49
cmp byte [rcx + 1], 0x25
je 0x140025f49
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.14000ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140025ebd
inc rcx
cmp byte [rcx], 0x20
je 0x140025eb5
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x140025f37
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140025ed6
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x140025f26
movss xmm2, dword [0x1400419f8]
nop dword [rax]
cmp al, 0x39
ja 0x140025f26
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140025f00
cmp dl, 0x2d
jne 0x140025f44
xorps xmm1, xmmword [0x140041a80]
movaps xmm0, xmm1
jmp 0x140025f4c
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140025f4c
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f0b0
add rsp, 0x80
pop rbx
ret

Function at 0x140025f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004e940]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140025fa8
cmp al, 0x25
jne 0x140025f9d
cmp byte [rcx + 1], al
jne 0x140025fa8
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140025f91
cmp byte [rcx], 0x25
jne 0x14002606b
cmp byte [rcx + 1], 0x25
je 0x14002606b
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.14000ba50
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140025fe9
inc rcx
cmp byte [rcx], 0x20
je 0x140025fe1
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x14002605d
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140026002
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x14002604c
movsd xmm2, qword [0x140045a40]
cmp al, 0x39
ja 0x14002604c
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140026028
cmp dl, 0x2d
jne 0x140026066
xorps xmm1, xmmword [0x140045a80]
movaps xmm0, xmm1
jmp 0x14002606e
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14002606e
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f0b0
add rsp, 0x80
pop rbx
ret
Function at 0x14003b340
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14004e940]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, r8d
mov rdi, rdx
xor edx, edx
cmp ecx, 0x7b
ja 0x14003b374
movsxd rax, ecx
lea rdx, [0x14004e2d0]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140046240]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
test rdx, rdx
jne 0x14003b3a3
mov r8d, 0xa
lea rdx, str.Select_Key
jmp 0x14003b3ba
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003b3b0
lea rcx, [rsp + 0x38]
call fcn.14003d960
cmp ebx, 1
jne 0x14003b3e0
mov r8d, 9
lea rdx, str.Press_Key
lea rcx, [rsp + 0x38]
call fcn.14003d960
mov dword [rsp + 0x30], 0x42fa0000
mov dword [rsp + 0x34], 0x41c80000
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.14002a0d0
test al, al
je 0x14003b431
test ebx, ebx
jne 0x14003b431
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14003b471
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b46c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b46c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ec74
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003f0b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140004290
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13b0]
mov eax, 0x14b0
call fcn.1400125a0
sub rsp, rax
mov r14d, edx
mov r15, rcx
mov rsi, qword [rbp + 0x1408]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ebx, dword [rbp + 0x1410]
mov ecx, ebx
call fcn.140001990
mov edi, eax
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x24], ebx
mov ecx, 1
lock xadd dword [0x14004ffd0], ecx
inc ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
lea rax, str.C:Usersmicha_slherpaderpingext_submoduleswilincludewil_resource.h
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], edi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x14004ff58]
test rax, rax
je 0x140004361
call rax
mov qword [rbp - 0x68], rax
jmp 0x140004365
mov qword [rbp - 0x68], r12
mov rax, qword [0x14004ff10]
test rax, rax
je 0x140004382
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff00]
test rax, rax
je 0x140004395
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff30]
test rax, rax
je 0x1400043a8
lea rcx, [rsp + 0x20]
call rax
mov eax, dword [rsp + 0x24]
mov ecx, 0x8000ffff
test eax, eax
cmovns eax, ecx
mov dword [rsp + 0x24], eax
cmp byte [0x14004fed0], r12b
jne 0x14000440b
mov rax, qword [0x14004fec0]
test rax, rax
je 0x1400043d7
call rax
movzx r12d, al
jmp 0x1400043e3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14000440b
mov rax, qword [0x14004fed8]
test rax, rax
je 0x140004461
cmp byte [0x14004fef0], r12b
jne 0x140004461
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x140004461
mov rax, qword [0x14004fed8]
test rax, rax
je 0x140004434
cmp byte [0x14004fef0], 0
jne 0x140004434
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x140004454
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001650
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x14004fee0], 0
je 0x140004479
mov rax, qword [0x14004ff20]
test rax, rax
je 0x140004479
call rax
nop
lea rcx, [rsp + 0x20]
call fcn.1400028b0
int3
Function at 0x140004490
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400046e0
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400125a0
sub rsp, rax
mov rax, qword [0x14004d110]
xor rax, rsp
mov qword [rbp + 0x13b0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1428]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ecx, dword [rbp + 0x1430]
call fcn.140001950
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x14004ffd0], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x14004ff58]
test rax, rax
je 0x1400047af
call rax
mov qword [rbp - 0x68], rax
jmp 0x1400047b3
mov qword [rbp - 0x68], r12
mov rax, qword [0x14004ff10]
test rax, rax
je 0x1400047d0
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff00]
test rax, rax
je 0x1400047e3
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff30]
test rax, rax
je 0x1400047f6
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x1400048e1
cmp byte [0x14004fed0], r12b
jne 0x140004852
mov rax, qword [0x14004fec0]
test rax, rax
je 0x14000481e
call rax
movzx r12d, al
jmp 0x14000482a
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x140004852
mov rax, qword [0x14004fed8]
test rax, rax
je 0x1400048a8
cmp byte [0x14004fef0], r12b
jne 0x1400048a8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x1400048a8
mov rax, qword [0x14004fed8]
test rax, rax
je 0x14000487b
cmp byte [0x14004fef0], 0
jne 0x14000487b
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x14000489b
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001650
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x14004fee0], 0
je 0x1400048c0
mov rax, qword [0x14004ff20]
test rax, rax
je 0x1400048c0
call rax
nop
mov rcx, qword [rbp + 0x13b0]
xor rcx, rsp
call fcn.140011ca0
add rsp, 0x14c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140002ae0
nop
int3
Function at 0x1400046e0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400046e0
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.1400125a0
sub rsp, rax
mov rax, qword [0x14004d110]
xor rax, rsp
mov qword [rbp + 0x13b0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1428]
xor r12d, r12d
mov word [rbp + 0x3b0], r12w
mov byte [rbp - 0x50], r12b
mov ecx, dword [rbp + 0x1430]
call fcn.140001950
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x14004ffd0], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x70], xmm1
mov rax, qword [0x14004ff58]
test rax, rax
je 0x1400047af
call rax
mov qword [rbp - 0x68], rax
jmp 0x1400047b3
mov qword [rbp - 0x68], r12
mov rax, qword [0x14004ff10]
test rax, rax
je 0x1400047d0
mov r8d, 0x400
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff00]
test rax, rax
je 0x1400047e3
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x14004ff30]
test rax, rax
je 0x1400047f6
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x1400048e1
cmp byte [0x14004fed0], r12b
jne 0x140004852
mov rax, qword [0x14004fec0]
test rax, rax
je 0x14000481e
call rax
movzx r12d, al
jmp 0x14000482a
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x140004852
mov rax, qword [0x14004fed8]
test rax, rax
je 0x1400048a8
cmp byte [0x14004fef0], r12b
jne 0x1400048a8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x1400048a8
mov rax, qword [0x14004fed8]
test rax, rax
je 0x14000487b
cmp byte [0x14004fef0], 0
jne 0x14000487b
mov r8d, 0x800
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3b0], 0
jne 0x14000489b
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3b0]
call fcn.140001650
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x14004fee0], 0
je 0x1400048c0
mov rax, qword [0x14004ff20]
test rax, rax
je 0x1400048c0
call rax
nop
mov rcx, qword [rbp + 0x13b0]
xor rcx, rsp
call fcn.140011ca0
add rsp, 0x14c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140002ae0
nop
int3
Function at 0x1400072b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14004d110]
xor rax, rsp
mov qword [rbp + 0x37], rax
lea rax, vtable.Parameters.0
mov qword [rbp - 0x49], rax
xor esi, esi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], si
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], 7
mov word [rbp - 0x21], si
mov byte [rbp + 0x1f], sil
mov dword [rbp + 0x27], 0x1f
mov word [rbp + 0x2b], si
mov dword [rbp + 0x2f], 5
movups xmm0, xmmword [str.Process_Herpaderping_Tool___Copyright__c__2020_Johnny_Shaw]
mov byte [rbp - 0x79], 1
movaps xmmword [rbp - 0x69], xmm0
movsd xmm0, qword [rbp - 0x79]
movsd qword [rbp - 0x59], xmm0
lea r9, [rbp - 0x49]
lea r8, [rbp - 0x69]
call fcn.140008c20
test eax, eax
jns 0x140007347
lea edi, [rsi + 1]
jmp 0x1400074c6
cmp byte [rbp + 0x2b], 0
je 0x140007355
mov dword [0x14004dc7c], esi
jmp 0x14000737f
mov r8d, 0x3a
mov rdx, qword [str.Process_Herpaderping_Tool___Copyright__c__2020_Johnny_Shaw]
lea rcx, section..data
call fcn.140007b00
mov rcx, rax
call fcn.1400076b0
mov eax, dword [rbp + 0x27]
mov dword [0x14004dc7c], eax
lea rax, str.rofl
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 4
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x69], xmm1
mov qword [rbp - 0x59], rsi
mov rbx, rsi
cmp byte [rbp + 0x2c], sil
je 0x140007437
mov edx, 0x200
lea rcx, [rbp - 0x69]
call fcn.140007d20
mov rbx, qword [rbp - 0x69]
mov rdi, qword [rbp - 0x61]
cmp rbx, rdi
jne 0x1400073ea
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x5f]
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov edx, 0x11e
call fcn.140002a60
jmp 0x14000741d
mov r8, rdi
sub r8, rbx
mov r9d, 2
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jns 0x14000742a
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov edx, 0x125
call fcn.140002a80
test eax, eax
jns 0x14000742a
lea r8, str.Failed_to_generate_random_buffer
jmp 0x14000746a
sub rdi, rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov eax, dword [rbp + 0x2f]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x30]
lea r8, [rbp - 1]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call fcn.140004930
test eax, eax
jns 0x14000747d
lea r8, str.Process_Herpaderp_Failed
mov edx, eax
mov ecx, 8
call fcn.140009a60
mov edi, 1
jmp 0x140007490
lea rdx, str.Process_Herpaderp_Succeeded
mov ecx, 1
call fcn.140009a20
mov edi, esi
test rbx, rbx
je 0x1400074c6
mov rdx, qword [rbp - 0x59]
sub rdx, rbx
cmp rdx, 0x1000
jb 0x1400074bd
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400074f0
mov rbx, rcx
mov rcx, rbx
call fcn.1400121ec
nop
lea rcx, [rbp - 0x49]
call fcn.140007500
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140011ca0
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
call fcn.140017ddc
nop
int3
Function at 0x14000a870
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14004d110]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rdx
mov rsi, rcx
xor edi, edi
mov dword [rdx], edi
mov ebp, edi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14000a8b3
mov edx, 0x132
jmp 0x14000a8cd
mov rax, qword [rsp + 0x30]
test rax, rax
jns 0x14000a904
mov ecx, 0x3ee
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x136
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov rcx, qword [rsp + 0x58]
call fcn.140002a60
mov ebx, eax
test eax, eax
jns 0x14000a907
mov rcx, qword [rsp + 0x58]
mov r9d, eax
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov edx, 0x2a7
call fcn.140002a40
mov eax, ebx
jmp 0x14000aa26
mov rbp, rax
mov r9, rbp
shr r9, 0x20
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x14000a964
mov rcx, qword [rsp + 0x58]
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov edx, 0x2b2
call fcn.140002a60
mov edi, eax
test rsi, rsi
je 0x14000aa24
cmp rsi, 0xffffffffffffffff
je 0x14000aa24
jmp 0x14000aa1a
mov eax, ebp
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x14000a98d
mov edx, 0x2ba
jmp 0x14000a9f8
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x14000a9a9
mov ecx, 0x241
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x2bf
jmp 0x14000a9f8
movsxd rcx, dword [rbx + 0x3c]
cmp dword [rcx + rbx], 0x4550
je 0x14000a9c8
mov ecx, 0x241
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x2c6
jmp 0x14000a9f8
mov edx, 0x10b
movzx eax, word [rcx + rbx + 0x18]
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x14000a9e8
mov eax, dword [rcx + rbx + 0x28]
mov dword [r14], eax
jmp 0x14000aa10
mov ecx, 0x241
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x2d4
lea r8, str.C:Usersmicha_slherpaderping_sourceProcessHerpaderpingutils.cpp
mov rcx, qword [rsp + 0x58]
call fcn.140002a60
mov edi, eax
test rbx, rbx
je 0x14000aa1a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011ca0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140010200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14004d110]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140010244
movzx eax, r14w
jmp 0x14001037a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140010280
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140010280
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14001037a
cmp qword [rcx + 0x80], r14
je 0x140010377
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400102be
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400102e7
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14001beb4
cmp ax, di
je 0x140010377
movzx edi, si
jmp 0x140010377
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x140034390]
test eax, eax
js 0x140010377
cmp eax, 1
jle 0x14001033c
cmp eax, 3
jne 0x140010377
movzx ecx, word [rbp + 7]
jmp 0x1400102ca
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140010366
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14001cc5c
cmp r14, rax
jne 0x140010377
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14001037a
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140011ca0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x140020edc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140020d08