joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c020
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov dword [rsp], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x10325476
mov rax, qword [rsp + 0x20]
mov dword [rax], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], 0
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x14007c970
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov dword [rsp], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0x10325476
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x20]
mov dword [rcx + rax + 0x4c], 0xc3d2e1f0
mov rax, qword [rsp + 0x20]
mov dword [rax], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], 0
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x140080870
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
mov r8d, 0x20
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 0x30]
mov dword [rcx + rax], 0x5be0cd19
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x60], 0
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x64], 0
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x68], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140087420
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rcx
push rdi
cmp qword [rsp + 0x10], 0
jne 0x140087438
mov eax, 0xffffff53
jmp 0x140087549
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xcbbb9d5dc1059ed8
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x629a292a367cd507
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x9159015a3070dd17
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x152fecd8f70e5939
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 4
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x67332667ffc00b31
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x8eb44a8768581511
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 6
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xdb0c2e0d64f98fa7
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 7
mov rcx, qword [rsp + 0x10]
movabs rdx, 0x47b5481dbefa4fa4
mov qword [rcx + rax], rdx
mov rax, qword [rsp + 0x10]
mov dword [rax + 0xc0], 0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0xc8], 0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0xd0], 0
xor eax, eax
pop rdi
ret
Function at 0x1400df660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x48]
dec eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x48]
dec eax
cdqe
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov byte [rsp + 0x28], al
mov eax, dword [rsp + 0x48]
dec eax
sub eax, dword [rsp + 0x50]
movzx ecx, byte [rsp + 0x28]
mov edx, eax
call fcn.1400d4d00
mov byte [rsp + 0x29], al
cmp dword [rsp + 0x24], 0xff
jle 0x1400df6be
mov dword [rsp + 0x24], 0xff
mov dword [rsp + 0x20], 0
jmp 0x1400df6d2
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jge 0x1400df723
movzx eax, byte [rsp + 0x28]
mov edx, eax
mov ecx, dword [rsp + 0x20]
call fcn.1400d4dc0
mov byte [rsp + 0x2a], al
movzx eax, byte [rsp + 0x2a]
mov ecx, dword [rsp + 0x48]
dec ecx
sub ecx, dword [rsp + 0x20]
movsxd rcx, ecx
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx]
movzx edx, byte [rsp + 0x28]
xor ecx, edx
and eax, ecx
movzx ecx, byte [rsp + 0x29]
or ecx, eax
mov eax, ecx
mov byte [rsp + 0x29], al
jmp 0x1400df6c8
movzx eax, byte [rsp + 0x29]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e9fa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
cmp qword [rsp + 0x60], 0
je 0x1400e9fd1
cmp qword [rsp + 0x68], 0
je 0x1400e9fd1
cmp qword [rsp + 0x70], 0
jne 0x1400e9fdb
mov eax, 0xffffff53
jmp 0x1400ea168
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
lea rdx, [0x140175e0c]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400ea022
xor eax, eax
test eax, eax
jne 0x1400ea012
mov eax, 0xffffff0c
jmp 0x1400ea168
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x1400ea054
xor eax, eax
test eax, eax
jne 0x1400ea039
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffff0c
jmp 0x1400ea168
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cdqe
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jge 0x1400ea089
xor eax, eax
test eax, eax
jne 0x1400ea06e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffff0c
jmp 0x1400ea168
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x1400ea0b8
xor eax, eax
test eax, eax
jne 0x1400ea09d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffff0c
jmp 0x1400ea168
cmp qword [rsp + 0x28], 0
jle 0x1400ea151
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
call fcn.14007a300
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x1400ea101
xor eax, eax
test eax, eax
jne 0x1400ea0f1
mov dword [rsp + 0x20], 0xffffff83
jmp 0x1400ea14f
mov r9, qword [rsp + 0x30]
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov edx, 1
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
cmp qword [rsp + 0x38], rax
jne 0x1400ea13f
mov dword [rsp + 0x40], 0
jmp 0x1400ea147
mov dword [rsp + 0x40], 0xffffffff
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
jmp 0x1400ea159
mov dword [rsp + 0x20], 0xffffff7c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ea180
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x24], 0
cmp qword [rsp + 0x60], 0
je 0x1400ea1b8
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
cmp qword [rsp + 0x50], 0
je 0x1400ea1c8
cmp qword [rsp + 0x58], 0
jne 0x1400ea1d2
mov eax, 0xffffff53
jmp 0x1400ea39f
mov r8d, 0x280
xor edx, edx
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x102
jle 0x1400ea206
mov eax, 0xffffff0c
jmp 0x1400ea39f
mov rax, qword [rsp + 0x50]
add rax, 0x178
mov r8d, 0x102
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x105
sub eax, dword [rsp + 0x24]
cdqe
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + rcx + 0x178]
mov r8, rax
lea rdx, [0x140175e10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
add rcx, 0x178
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x140], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x140], 0xffffffffffffffff
jne 0x1400ea297
xor eax, eax
test eax, eax
jne 0x1400ea287
mov eax, 0xffffff0c
jmp 0x1400ea39f
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
and eax, 0x10
test eax, eax
jne 0x1400ea36f
mov rax, qword [rsp + 0x50]
add rax, 0x2c
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
lea eax, [rax + rcx + 2]
cmp eax, 0x105
jle 0x1400ea2db
mov eax, 0xffffff0c
jmp 0x1400ea39f
movsxd rax, dword [rsp + 0x24]
inc rax
mov rcx, qword [rsp + 0x50]
add rcx, 0x178
mov r8, rax
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax + 0x178], 0x5c
mov eax, 0x105
sub eax, dword [rsp + 0x24]
dec eax
cdqe
mov rcx, qword [rsp + 0x50]
add rcx, 0x2c
movsxd rdx, dword [rsp + 0x24]
mov r8, qword [rsp + 0x50]
lea rdx, [r8 + rdx + 0x179]
mov qword [rsp + 0x30], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
cmp qword [rsp + 0x60], 0
je 0x1400ea36b
mov rax, qword [rsp + 0x50]
add rax, 0x178
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
xor eax, eax
jmp 0x1400ea39f
mov rax, qword [rsp + 0x50]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400ea297
mov rcx, qword [rsp + 0x50]
call fcn.1400ea550
mov eax, dword [rsp + 0x20]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ea890
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
cmp qword [rsp + 0x40], 0
je 0x1400ea8b4
cmp qword [rsp + 0x48], 0
jne 0x1400ea8bb
mov eax, 0xffffff53
jmp 0x1400ea908
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x1400ea906
mov rax, qword [rsp + 0x40]
mov qword [rax], 0xffffffffffffffff
mov eax, 0xffffff83
jmp 0x1400ea908
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400eac50
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0xc], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0xc], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0xc], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax + 0xc], 0x10325476
mov rax, qword [rsp + 0x10]
mov dword [rax], 0
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0x10]
mov dword [rax + 8], 0
pop rdi
ret

Function at 0x1400ebf40
Capabilities:
Generate random numbers via winapi

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400ebf80
mov eax, 0xffffff99
jmp 0x1400ebfb4
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400ebfa2
mov eax, 0xffffff98
jmp 0x1400ebfb4
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140101600
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.1401025e0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140101660
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.1401025e0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140115170
Capabilities:
Encrypt data using aes

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140115191
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1401151e6
mov dword [rsp + 8], 0
jmp 0x1401151ad
mov eax, dword [rsp + 8]
add eax, 0x10
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0x100
jge 0x1401151e4
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x400
lea rcx, [0x140156770]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
mov ecx, dword [rsp]
and ecx, eax
mov eax, ecx
mov dword [rsp], eax
jmp 0x1401151a2
jmp 0x140115187
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret
Function at 0x140117cb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140117cd1
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x140117d26
mov dword [rsp + 8], 0
jmp 0x140117ced
mov eax, dword [rsp + 8]
add eax, 0x10
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0x100
jge 0x140117d24
movsxd rax, dword [rsp + 4]
imul rax, rax, 0x400
lea rcx, [0x140157770]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 8]
mov eax, dword [rax + rcx*4]
mov ecx, dword [rsp]
and ecx, eax
mov eax, ecx
mov dword [rsp], eax
jmp 0x140117ce2
jmp 0x140117cc7
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x140117d40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
sub rsp, 0x10
mov dword [rsp], 0
mov dword [rsp + 4], 0
jmp 0x140117d62
mov eax, dword [rsp + 4]
add eax, 0x40
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0x100
jge 0x140117d88
movsxd rax, dword [rsp + 4]
lea rcx, [0x140158770]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp]
and ecx, eax
mov eax, ecx
mov dword [rsp], eax
jmp 0x140117d57
mov eax, dword [rsp]
add rsp, 0x10
pop rdi
ret
Function at 0x1401335b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140133602
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140133602
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140133602
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140133602
cmp dword [rcx + 0x84], 0xe
jbe 0x140133602
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140133604
xor al, al
add rsp, 0x28
ret
Function at 0x140005b30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8d, dword [0x140029d70]
lea rdi, [0x140029d70]
mov r9d, 0x270
cmp r8d, r9d
jne 0x140005ba7
lea r8, [0x140029d78]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140005b66
mov r8d, dword [0x140029d70]
jmp 0x140005c7b
cmp r8d, 0x4e0
jb 0x140005c7b
xor r8d, r8d
mov r10d, 0x7fffffff
mov ebx, r8d
mov r11d, 0x9908b0df
mov r9d, 0x38c
mov eax, dword [rbx + rdi + 0x9c4]
mov edx, eax
xor edx, dword [rbx + rdi + 0x9c8]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [rbx + rdi + 0xff8]
xor ecx, edx
mov dword [rbx + rdi + 4], ecx
add rbx, 4
cmp rbx, r9
jb 0x140005bcc
mov eax, dword [r9 + rdi + 0x9c4]
mov edx, eax
xor edx, dword [r9 + rdi + 0x9c8]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + rdi - 0x388]
xor ecx, edx
mov dword [r9 + rdi + 4], ecx
add r9, 4
cmp r9, 0x9bc
jb 0x140005c04
mov edx, dword [0x14002b0f0]
xor edx, dword [0x140029d74]
and edx, r10d
mov dword [0x140029d70], r8d
xor edx, dword [0x14002b0f0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, edx
xor ecx, dword [0x14002a3a4]
mov dword [0x14002a730], ecx
mov rbx, qword [rsp + 8]
mov eax, r8d
mov ecx, dword [rdi + rax*4 + 4]
inc eax
mov rdi, qword [rsp + 0x10]
mov dword [0x140029d70], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x14002b0f4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x140006408
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov ebx, 0x104
lea rdx, [rbp + 0x60]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
or rdi, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
mov r8, rdi
movdqu xmmword [rsp + 0x40], xmm1
inc r8
cmp byte [rax + r8], 0
jne 0x140006464
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140006044
lea rax, [rbp + 0x60]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006481
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea r9, [rbp + 0x60]
mov rdx, qword [rsp + 0x40]
cmp rsi, 0xf
mov qword [rsp + 0x20], rdi
cmova rcx, rbx
call fcn.140005fa0
test rax, rax
sete dil
cmp rsi, 0xf
jbe 0x1400064ee
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400064e6
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000650a
mov rcx, rbx
call fcn.1400072a8
lea r11, [rsp + 0x270]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14000d1a0
int3
Function at 0x1400065bc
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400065ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x38], 0
jne 0x1400065ef
add rsp, 0x28
ret
mov ecx, 1
call fcn.14000cc40
int3
Function at 0x140006884
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dil, byte [r9]
mov rbx, rdx
mov rdx, qword [r8]
xor eax, eax
xorps xmm0, xmm0
or r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
inc r8
cmp byte [rdx + r8], al
jne 0x1400068ab
mov rcx, rbx
call fcn.140006044
cmp qword [rbx + 0x18], 0xf
jbe 0x1400068cb
mov rdx, qword [rbx]
mov rcx, rdx
jmp 0x1400068d1
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbx + 0x10]
add r8, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400068e5
mov rcx, qword [rbx]
cmp rcx, r8
je 0x1400068fd
sub rdx, rcx
mov al, dil
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
cmp rcx, r8
jne 0x1400068ed
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140007a60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007aaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007aaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007aaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007aaa
cmp dword [rcx + 0x84], 0xe
jbe 0x140007aaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007aac
xor al, al
add rsp, 0x28
ret

Function at 0x14000ca3c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000caab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000caab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000caab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000caab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000caab
cmp dword [rcx + 0x84], 0xe
jbe 0x14000caab
cmp dword [rcx + 0xf8], 0
je 0x14000caab
mov ecx, ebx
call fcn.14000cb5c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000c938
nop
cmp dword [rbp + 0x20], 0
je 0x14000caf9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000cb04
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000ca3c
Function at 0x14000cc40
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000caab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000caab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000caab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000caab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000caab
cmp dword [rcx + 0x84], 0xe
jbe 0x14000caab
cmp dword [rcx + 0xf8], 0
je 0x14000caab
mov ecx, ebx
call fcn.14000cb5c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000c938
nop
cmp dword [rbp + 0x20], 0
je 0x14000caf9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000cb04
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000ca3c