joyce8/EMBER2024-capa huggingface dataset:
Function at 0x333bc
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x0003b540]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x33558
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x3351a
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x33545
cmp rbx, 0x6400000
ja 0x33545
mov rdx, rbx
mov ecx, edi
call fcn.000353f8
mov rdi, rax
test rax, rax
je 0x33515
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x33506
mov rcx, rdi
call fcn.00035470
mov ebx, esi
jmp 0x3351a
cmp qword [rsp + 0x58], rbx
je 0x3352c
mov rcx, rdi
call fcn.00035470
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x33558
mov rcx, qword [rsp + 0xe0]
mov qword [0x0004ceb8], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x33558
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x33574
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x33598
xor al, al
jmp 0x335bf
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x335d0
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x335f4
lea rax, [0x0003a420]
jmp 0x33664
mov rcx, qword [rsp + 0x38]
call fcn.00039b5e
mov r11, rax
test rax, rax
jne 0x33613
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x335eb
lea rdi, [0x0004cdb0]
mov byte [0x0004ceb3], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x3364b
mov al, byte [r11 + rcx]
test al, al
je 0x3364b
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x3362c
test rdx, rdx
jne 0x33653
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x33988
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x0004ced0]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x33a69
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x339cf
xor eax, eax
jmp 0x33a69
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.000353f8
mov rbx, rax
test rax, rax
je 0x339c8
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x33a08
mov rcx, rbx
call fcn.00035470
jmp 0x339c8
xor edi, edi
cmp dword [rbx], edi
jbe 0x33a5a
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0003d680]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.00039b46
test eax, eax
je 0x33a45
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x33a12
jmp 0x33a5a
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x0004ced0], rax
mov rcx, rbx
call fcn.00035470
mov rax, qword [0x0004ced0]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x340bc
Capabilities:
Attach user process memory
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov byte [rax + 8], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor ebx, ebx
and dword [rsp + 0x88], ebx
mov esi, 0x4000
mov rbp, rax
mov edi, esi
xor r12b, r12b
test rbx, rbx
je 0x340f6
mov rcx, rbx
call fcn.00035470
mov edx, edi
mov ecx, 1
call fcn.000353f8
mov rbx, rax
test rax, rax
je 0x341d4
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rax
mov ecx, 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
add edi, esi
cmp eax, 0xc0000004
je 0x340e9
test eax, eax
js 0x341cc
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbp, rax
je 0x34185
and qword [rsp + 0x90], 0
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x341cc
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r12b, 1
xor esi, esi
cmp dword [rbx], esi
jbe 0x341bc
lea rdi, [rbx + 0xe]
cmp ebp, dword [rdi - 6]
jne 0x341b2
movzx edx, word [rdi]
lea r9, [rsp + 0x80]
lea r8, [fcn.00034058]
mov rcx, rbp
call fcn.00035fa8
test al, al
je 0x341bc
inc esi
add rdi, 0x18
cmp esi, dword [rbx]
jb 0x3418f
test r12b, r12b
je 0x341cc
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call fcn.00035470
mov al, byte [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x34990
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x34acb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x34ac0
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00034868
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x34ab2
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x34ab2
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00034aec
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x35070
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x350ac
cmp dword [rsp + 0x48], 2
jne 0x351aa
lea eax, [r11 - 2]
jmp 0x351ac
cmp r11d, 6
jne 0x35147
mov ecx, dword [rsp + 0x48]
xor eax, eax
cmp ecx, eax
jne 0x350c8
mov eax, r11d
jmp 0x351ac
cmp ecx, 1
jne 0x350f3
cmp dword [rsp + 0x40], 0x1b58
jne 0x350df
lea eax, [rcx + 7]
jmp 0x351ac
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x351ac
cmp ecx, 2
jne 0x35130
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x203a
jne 0x3510e
mov eax, 0xe
jmp 0x351ac
cmp ecx, 0x20d0
jne 0x35120
mov eax, 0xf
jmp 0x351ac
mov edx, 0x11
cmp ecx, 0x23f0
cmove eax, edx
jmp 0x351ac
cmp ecx, 3
jne 0x351aa
cmp dword [rsp + 0x40], 0x2580
mov ecx, 0x14
cmove eax, ecx
jmp 0x351ac
cmp r11d, 0xa
jne 0x351aa
xor eax, eax
cmp dword [rsp + 0x48], eax
jne 0x351aa
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x295a
jne 0x35167
lea eax, [r11 + 0x15]
jmp 0x351ac
cmp ecx, 0x2945
jne 0x35176
mov eax, 0x1d
jmp 0x351ac
cmp ecx, 0x2933
jne 0x35185
mov eax, 0x1b
jmp 0x351ac
cmp ecx, 0x2924
jne 0x35194
mov eax, 0x19
jmp 0x351ac
add ecx, 0xffffd800
mov edx, 0x17
cmp ecx, 0x124
cmovbe eax, edx
jmp 0x351ac
xor eax, eax
add rsp, 0x38
ret
Function at 0x351b8
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x35297
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.000353f8
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x3527a
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.00039bc0
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x35281
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x352b4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x353d6
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x353b6
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.000353f8
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x353ab
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.00039bc0
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x353bd
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x3588c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x358cd
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x358c1
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x358d0
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x358ac
xor r8d, r8d
test r8, r8
je 0x358e8
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x358ea
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x358f8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x35937
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x3592b
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x3593a
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x35916
xor r8d, r8d
test r8, r8
je 0x35952
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x35954
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x35960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x35ad8
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x35ad8
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x35ad8
test r8b, r8b
jne 0x359b4
mov rcx, rsi
call fcn.000358f8
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x35ad8
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x35ad8
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x35ad8
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x359fd
mov rcx, rsi
call fcn.000358f8
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x35a19
mov rcx, rsi
call fcn.000358f8
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x35a31
mov rcx, rsi
call fcn.000358f8
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x35ad8
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x35ad8
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x35ad8
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x35ad8
cmp ebp, edx
jge 0x35ad8
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x35a90
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x35ad0
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x35aa7
mov rcx, rsi
call fcn.000358f8
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x35ac8
inc rdx
test ecx, ecx
jne 0x35ab5
test eax, eax
je 0x35af2
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x35a61
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x35b05
mov rcx, rsi
call fcn.000358f8
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x35ada

Function at 0x35b14
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x35b5a
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x35b5a
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x35b5a
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x35b4e
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x35b5d
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x35b3e
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x360c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x361bb
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x361bb
mov rax, rdx
add rax, rcx
je 0x361bb
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x361b9
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x361b5
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x36171
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x361a9
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x36194
inc rax
test r11d, r11d
jne 0x3617e
cmp r10d, r8d
jne 0x361a4
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x361b9
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x3614d
xor eax, eax
jmp 0x361ca
jmp 0x361c7
xor eax, eax
jmp 0x361ca
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x378a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r12d, r8d
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp r8d, 0x40
jbe 0x3790f
lea ebx, [r8 - 0x41]
shr ebx, 6
inc ebx
mov rdx, rbp
mov rcx, rsi
call fcn.00037050
add r12d, 0xffffffc0
add rbp, 0x40
sub rbx, 1
jne 0x378f6
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
call fcn.0003a110
lea rcx, [rsp + 0x20]
mov r8d, r12d
mov rdx, rbp
mov ebx, r12d
call fcn.00039bc0
lea eax, [r12 + 1]
mov byte [rsp + rbx + 0x20], 0x80
cmp eax, 0x38
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov eax, edi
ja 0x3798b
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x58], al
shr eax, 8
mov byte [rsp + 0x5c], dil
shr edi, 8
mov byte [rsp + 0x59], al
shr eax, 8
mov byte [rsp + 0x5d], dil
shr edi, 8
mov byte [rsp + 0x5a], al
shr eax, 8
mov byte [rsp + 0x5e], dil
shr edi, 8
mov byte [rsp + 0x5f], dil
mov byte [rsp + 0x5b], al
jmp 0x379ec
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x98], al
mov byte [rsp + 0x9c], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x99], al
shr eax, 8
mov byte [rsp + 0x9d], dil
shr edi, 8
mov byte [rsp + 0x9a], al
mov byte [rsp + 0x9e], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9f], dil
call fcn.00037050
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.00037050
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.00039af0
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x38034
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx]
mov eax, dword [rdx]
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + rax + 1]
xor r8d, r8d
mov rcx, rbp
call fcn.00037ac8
mov r11, qword [rdi + 0x10]
movsxd rsi, dword [rdi]
add rsi, r11
xor r13d, r13d
cmp r11, rsi
jae 0x3813a
lea r15d, [r13 + 1]
mov r9, qword [rbx + 0x10]
movsxd r10, dword [rbx]
add r10, r9
cmp r9, r10
jae 0x3812b
mov r14, r13
mov rax, qword [rbp + 0x10]
movzx r8d, byte [r9]
xor edx, edx
lea r12, [r14 + rax]
movzx eax, byte [r11]
imul r8w, ax
mov eax, 0xff
movzx ecx, r8w
and cx, ax
movzx eax, byte [r12]
add cx, ax
mov eax, 0x100
cmp cx, ax
mov byte [r12], cl
mov ecx, 0x100
cmovae edx, r15d
add r12, r15
shr r8w, 8
movzx eax, byte [r12]
add r8w, ax
xor eax, eax
add r8w, dx
cmp r8w, cx
mov byte [r12], r8b
setae al
add r12, r15
test eax, eax
je 0x3811c
movzx eax, byte [r12]
add ax, r15w
mov byte [r12], al
add r12, r15
cmp ax, cx
jae 0x38107
add r9, r15
add r14, r15
cmp r9, r10
jb 0x3809e
add r11, r15
add r13, r15
cmp r11, rsi
jb 0x38088
mov eax, dword [rdi + 8]
mov rcx, rbp
xor eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.00037bc4
Function at 0x38d4c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x740
xor r14d, r14d
mov rbp, r8
mov r10, rdx
lea r12d, [r14 + 1]
lea r13d, [r14 + 4]
mov r11, rcx
movzx r9d, r14w
movsx rax, r9w
add r9w, r12w
mov dword [r8 + rax*4], r14d
cmp r9w, r13w
jb 0x38d84
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r10 + rcx*4]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, r13w
jb 0x38d9a
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r11 + rcx*4]
mov dword [rsp + rcx*4 + 0x30], eax
cmp dx, r13w
jb 0x38db4
mov edi, 0x70
mov r11, r13
lea rbx, [rsp + 0x40]
mov rsi, rdi
movzx r8d, r14w
movsx rax, r8w
add r8w, r12w
lea rdx, [r11 + rax]
lea rcx, [r11 + rax - 4]
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rdx*4 + 0x30], eax
cmp r8w, r13w
jb 0x38dde
mov rcx, rbx
call fcn.00038d08
add r11, r13
add rbx, 0x10
sub rsi, r12
jne 0x38dda
movsx r9, word [0x0004bfc0]
movzx r8d, r14w
movsx rdx, r8w
add r8w, r12w
lea rax, [rdx + r9*4]
mov ecx, dword [rsp + rax*4 + 0x30]
and ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rbp + rdx*4], ecx
cmp r8w, r13w
jb 0x38e1d
lea r11, [0x0004c188]
lea rcx, [rsp + 0x20]
call fcn.00038d08
movsx r10, word [r11]
movsx rbx, word [r11 - 0x1c6]
movzx r9d, r14w
movsx r8, r9w
add r9w, r12w
lea rcx, [r8 + r10*4]
lea rax, [r8 + rbx*4]
mov edx, dword [rsp + rcx*4 + 0x30]
xor edx, dword [rsp + rax*4 + 0x30]
and edx, dword [rsp + r8*4 + 0x20]
xor dword [rbp + r8*4], edx
cmp r9w, r13w
jb 0x38e5c
add r11, 2
sub rdi, r12
jne 0x38e42
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret