joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100044720
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov dword [rbp - 8], ecx
mov dword [rbp - 0x10], edx
mov byte [rbp - 0x18], r8b
lea r8, [rbp - 0x24]
mov edx, dword [rbp - 0x10]
mov ecx, dword [rbp - 8]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
mov dword [rbp - 0x28], eax
cmp eax, 2
jle 0x1000447d2
mov eax, dword [rbp - 0x28]
sub eax, 2
test eax, eax
jl 0x1000447ef
mov dword [rbp - 0x2c], 0xffffffff
nop dword [rax]
mov edx, dword [rbp - 0x2c]
add edx, 1
mov dword [rbp - 0x2c], edx
mov dx, word [rbp + rdx*2 - 0x24]
mov word [rbp - 0x30], dx
mov edx, dword [rbp - 0x2c]
mov dx, word [rbp + rdx*2 - 0x24]
cmp dx, 0x20
jb 0x1000447ef
sub dx, 0x20
je 0x1000447c8
sub dx, 0x80
je 0x1000447c8
sub dx, 0x1f62
jb 0x1000447ef
sub dx, 1
jbe 0x1000447c8
sub dx, 6
je 0x1000447c8
sub dx, 0x26
jne 0x1000447ef
nop
jmp 0x1000447c8
cmp eax, dword [rbp - 0x2c]
jg 0x100044770
nop dword [rax]
jmp 0x1000447ef
cmp dword [rbp - 0x28], 2
jne 0x1000447e2
mov ax, word [rbp - 0x24]
mov word [rbp - 0x30], ax
jmp 0x1000447ef
movzx ecx, byte [rbp - 0x18]
call fcn.10000bd30
mov word [rbp - 0x30], ax
mov ax, word [rbp - 0x30]
sub ax, 0x7f
jbe 0x10004486c
sub ax, 0x21
je 0x100044880
sub ax, 0x17
je 0x10004488c
sub ax, 0x222
je 0x100044898
sub ax, 0x392
je 0x1000448a0
sub ax, 1
je 0x1000448a8
sub ax, 0x1996
je 0x1000448b0
sub ax, 1
je 0x1000448b8
sub ax, 6
je 0x1000448c0
sub ax, 0xb
je 0x1000448d0
sub ax, 0x1b
je 0x1000448c8
sub ax, 0x367
je 0x1000448d8
jmp 0x1000448e0
movzx ecx, word [rbp - 0x30]
call fcn.10000bde0
mov byte [rbp - 0x1c], al
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x20
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x2e
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x27
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x2c
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x27
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x20
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x20
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x20
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x20
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x2d
jmp 0x1000448e8
mov byte [rbp - 0x1c], 0x27
jmp 0x1000448e8
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x1c], al
nop
movzx eax, byte [rbp - 0x1c]
nop
lea rsp, [rbp]
pop rbp
ret

Function at 0x100059f00
Capabilities:
Resume thread

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov rbx, rcx
mov rcx, qword [rbx + 8]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x100059f20
mov dword [rbx + 0x14], 0
nop
nop
lea rsp, [rsp + 0x20]
pop rbx
ret
Function at 0x100089930
Capabilities:
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x18], 0
nop
mov rax, qword [rbp - 8]
lea rcx, [rbp - 0x18]
mov rdx, rax
call fcn.10000d290
mov rcx, qword [rbp - 0x18]
test rcx, rcx
jne 0x100089966
lea rcx, [0x1003cb460]
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0xc], eax
nop
mov rcx, rbp
call fcn.100089910
mov eax, dword [rbp - 0xc]
nop
lea rsp, [rbp]
pop rbp
ret

Function at 0x1000ad050
Capabilities:
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
nop dword [rax]
add eax, 1
mov ecx, eax
mov r8d, 0xffffffff
nop dword [rax + rax]
add r8d, 1
mov edx, ecx
and edx, 1
cmp edx, 1
jne 0x1000ad084
mov edx, ecx
shr edx, 1
xor edx, 0xedb88320
mov ecx, edx
jmp 0x1000ad086
shr ecx, 1
cmp r8d, 7
jl 0x1000ad068
mov edx, eax
lea r9, [0x1003cd7b0]
mov dword [r9 + rdx*4], ecx
cmp eax, 0xff
jl 0x1000ad058
ret

Function at 0x1000ad0b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, ecx
lea ecx, [r8d - 1]
test ecx, ecx
jl 0x1000ad100
mov r8d, 0xffffffff
nop word [rax + rax]
add r8d, 1
mov r9b, al
xor r9b, byte [rdx]
and r9d, 0xff
mov r10d, r9d
and r9d, r9d
mov r11d, eax
shr r11d, 8
lea rbx, [0x1003cd7b0]
xor r11d, dword [rbx + r9*4]
mov eax, r11d
add rdx, 1
cmp ecx, r8d
jg 0x1000ad0c8
nop dword [rax]
pop rbx
ret

Function at 0x1000af480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rsi
mov rbx, rcx
mov rsi, rdx
mov qword [rbp - 8], 0
nop
mov rax, qword [0x1003cc380]
test rax, rax
je 0x1000af4ba
mov ecx, dword [0x1003cdbb0]
call rax
jmp 0x1000af4c1
lea rax, [0x1003cdbb8]
mov word [rax], 0
lea rdx, [rbx + 0x78]
lea rcx, [rbp - 8]
mov r8d, 0xff
call fcn.10000d4c0
mov rcx, qword [rbp - 8]
test rcx, rcx
jne 0x1000af4e9
lea rcx, [0x1003cb460]
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000af523
call sub.kernel32.dll_GetLastError
mov edi, eax
mov rax, qword [0x1003cc380]
test rax, rax
je 0x1000af512
mov ecx, dword [0x1003cdbb0]
call rax
jmp 0x1000af519
lea rax, [0x1003cdbb8]
mov word [rax], di
mov word [rsi], 0
jmp 0x1000af52d
mov eax, ebx
and eax, 0xffff
mov word [rsi], ax
nop
mov rcx, rbp
call fcn.1000af460
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000af5a0
Capabilities:
Hash data with crc32

Disassembly:
test rdx, rdx
jne 0x1000af5a8
xor eax, eax
ret
xor ecx, 0xffffffff
jmp 0x1000af6ec
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
sub r8d, 8
cmp r8d, 8
jae 0x1000af5b0
jmp 0x1000af723
movzx r9d, byte [rdx]
xor r9d, ecx
and r9d, 0xff
mov r10d, ecx
shr r10d, 8
lea r11, [0x100246640]
xor r10d, dword [r11 + r9*4]
mov ecx, r10d
add rdx, 1
sub r8d, 1
test r8d, r8d
ja 0x1000af6f8
xor ecx, 0xffffffff
mov eax, ecx
ret
Function at 0x1000b0590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x28]
mov rbx, rcx
mov r14d, dword [rbx + 0x34]
nop dword [rax]
mov rax, rbx
mov edx, dword [rax + 0x48]
mov ecx, dword [rax + 0x8c]
sub edx, ecx
sub edx, dword [rax + 0x84]
mov esi, edx
test edx, edx
jne 0x1000b05df
mov rax, rbx
cmp dword [rax + 0x84], 0
jne 0x1000b05df
cmp dword [rax + 0x8c], 0
jne 0x1000b05df
mov esi, r14d
jmp 0x1000b06b8
cmp esi, 0xffffffff
jne 0x1000b05ef
sub esi, 1
jmp 0x1000b06b8
mov ecx, dword [rbx + 0x84]
mov eax, r14d
lea rdx, [rax - 0x106]
add rax, rdx
cmp rcx, rax
jl 0x1000b06b8
mov rdx, qword [rbx + 0x40]
mov eax, r14d
lea rcx, [rdx + rax]
mov rdx, qword [rbx + 0x40]
mov r8d, r14d
call fcn.100002ec0
sub dword [rbx + 0x88], r14d
sub dword [rbx + 0x84], r14d
mov eax, r14d
sub dword [rbx + 0x74], eax
mov edi, dword [rbx + 0x64]
mov rdx, qword [rbx + 0x58]
mov eax, edi
lea r12, [rdx + rax*2]
nop dword [rax + rax]
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r14d, r13d
ja 0x1000b0668
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x1000b066f
mov word [r12], 0
sub edi, 1
jne 0x1000b0648
mov edi, r14d
mov rdx, qword [rbx + 0x50]
mov eax, edi
lea r12, [rdx + rax*2]
nop dword [rax]
sub r12, 2
movzx eax, word [r12]
mov r13d, eax
cmp r14d, r13d
ja 0x1000b06a8
mov eax, r13d
mov edx, r14d
sub eax, edx
mov word [r12], ax
jmp 0x1000b06af
mov word [r12], 0
sub edi, 1
jne 0x1000b0688
add esi, r14d
nop
mov rax, qword [rbx]
cmp dword [rax + 8], 0
je 0x1000b0758
nop dword [rax]
mov rax, rbx
mov rcx, qword [rax + 0x40]
mov edx, dword [rax + 0x84]
mov eax, dword [rax + 0x8c]
add rax, rdx
lea rdx, [rcx + rax]
mov rcx, qword [rbx]
mov r8d, esi
call fcn.1000b0160
mov edi, eax
add dword [rbx + 0x8c], edi
cmp dword [rbx + 0x8c], 3
jb 0x1000b073c
mov rax, rbx
mov rdx, qword [rax + 0x40]
mov eax, dword [rax + 0x84]
movzx eax, byte [rdx + rax]
mov dword [rbx + 0x60], eax
mov rax, rbx
mov rcx, qword [rax + 0x40]
mov edx, dword [rax + 0x84]
movzx r9d, byte [rcx + rdx + 1]
mov edx, dword [rax + 0x70]
mov r8d, dword [rax + 0x60]
mov ecx, edx
shl r8d, cl
xor r9d, r8d
and r9d, dword [rax + 0x6c]
mov dword [rbx + 0x60], r9d
mov rax, rbx
cmp dword [rax + 0x8c], 0x106
jae 0x1000b0758
mov rax, qword [rax]
cmp dword [rax + 8], 0
jne 0x1000b05a8
nop
lea rsp, [rsp + 0x28]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x1000d1a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor eax, eax
lea rdx, [rcx + 1]
movzx r8d, byte [rcx]
add r8d, 1
and r8d, 0xff
add rcx, r8
jmp 0x1000d1a3b
mov r8d, eax
shl r8d, 5
mov r9d, eax
sub r8d, r9d
movzx r9d, byte [rdx]
xor r8d, r9d
mov eax, r8d
add rdx, 1
cmp rcx, rdx
ja 0x1000d1a20
ret
Function at 0x1000df6d0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov rbx, rcx
cmp dword [rbx + 0x24], 0xca
jne 0x1000df70c
mov rcx, rbx
call fcn.1000e4150
cmp byte [rbx + 0x50], 0
je 0x1000df704
mov dword [rbx + 0x24], 0xcf
mov dil, 1
jmp 0x1000df7cf
mov dword [rbx + 0x24], 0xcb
nop
cmp dword [rbx + 0x24], 0xcb
jne 0x1000df7aa
mov rax, qword [rbx + 0x208]
cmp byte [rax + 0x20], 0
je 0x1000df79c
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x1000df740
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rcx, rbx
mov rax, qword [rbx + 0x208]
call qword [rax]
mov esi, eax
test eax, eax
jne 0x1000df75c
xor dil, dil
jmp 0x1000df7cf
cmp esi, 2
je 0x1000df79a
nop dword [rax]
cmp qword [rbx + 0x10], 0
je 0x1000df730
cmp esi, 3
je 0x1000df775
cmp esi, 1
jne 0x1000df730
mov rax, qword [rbx + 0x10]
add dword [rax + 8], 1
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + 8]
cmp edx, dword [rax + 0xc]
jl 0x1000df730
mov rdx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x16c]
add dword [rdx + 0xc], eax
nop
jmp 0x1000df730
nop
mov eax, dword [rbx + 0x84]
mov dword [rbx + 0x8c], eax
jmp 0x1000df7c4
cmp dword [rbx + 0x24], 0xcc
je 0x1000df7c4
mov r8d, dword [rbx + 0x24]
mov rcx, rbx
mov edx, 0x14
call fcn.1000dfbc0
mov rcx, rbx
call fcn.1000df7e0
mov dil, al
mov al, dil
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret

Function at 0x100108710
Capabilities:
Inspect load icon resource

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x80]
mov qword [rbp - 8], rcx
mov dword [rbp - 0x58], 8
lea rax, [fcn.100106c70]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0
mov dword [rbp - 0x44], 0
call fcn.100015870
mov qword [rbp - 0x40], rax
mov rcx, qword [0x1003cb430]
lea rdx, str.MAINICON
call sub.user32.dll_LoadIconA
mov qword [rbp - 0x38], rax
test rax, rax
jne 0x100108774
mov edx, 0x7f00
xor ecx, ecx
call sub.user32.dll_LoadIconA
mov qword [rbp - 0x38], rax
nop
mov edx, 0x7f00
xor ecx, ecx
call sub.user32.dll_LoadCursorA
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
lea rax, str.Window
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x58]
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [rbp - 0xc]
cmp byte [rbp - 0xc], 0
je 0x1001087f8
or dword [rbp - 0x58], 0x800
cmp dword [0x1002a2ba0], 6
jb 0x1001087cc
or dword [rbp - 0x58], 0x20000
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x28], 0
lea rax, str.HintWindow
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x58]
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [rbp - 0xc]
nop
mov al, byte [rbp - 0xc]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x100109ab0
Capabilities:
Read clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x40]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov byte [rbp - 0x14], 0
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax - 0x10]
call sub.user32.dll_GetClipboardData
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x30], rax
mov rax, qword [rbp - 0x10]
cmp qword [rax - 0x30], 0
je 0x100109b48
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalSize
mov rdx, qword [rbp - 0x10]
mov dword [rdx - 0x3c], eax
mov rax, qword [rbp - 0x10]
cmp dword [rax - 0x3c], 0
jle 0x100109b48
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax - 0x30]
call sub.kernel32.dll_GlobalLock
mov rdx, qword [rbp - 0x10]
mov qword [rdx - 0x38], rax
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax - 0x38]
mov rax, qword [rbp - 0x10]
mov r8d, dword [rax - 0x3c]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 8]
mov rax, qword [rax]
call qword [rax + 0x108]
nop
mov rcx, rbp
call fcn.100109a90
mov byte [rbp - 0x14], 1
nop
mov al, byte [rbp - 0x14]
nop
lea rsp, [rbp]
pop rbp
ret
Function at 0x10010a2e0
Capabilities:
Write clipboard data

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x18], rcx
mov dword [rbp - 8], edx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x38], 0
nop
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx]
mov rcx, rax
call qword [rdx + 0xe0]
mov rdx, rax
mov ecx, 2
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x10010a448
lea rcx, [rbp - 0x38]
call fcn.100009020
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov qword [rbp - 0x40], rax
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.10008b5b0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x48]
call fcn.100009020
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.10008b610
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
call fcn.10008bdf0
mov rbx, rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, str._DataSize
mov r8, qword [rbp - 0x40]
lea rdx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov rcx, rbx
call fcn.10008d6d0
mov rax, qword [rbp - 0x18]
mov byte [rax - 0x24], 0
jmp 0x10010a495
mov rcx, qword [rbp - 0x20]
call sub.kernel32.dll_GlobalLock
mov qword [rbp - 0x28], rax
nop
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0xe0]
mov r8, rax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
call qword [rax + 0x100]
nop
mov rcx, rbp
call fcn.10010a290
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 8]
call sub.user32.dll_SetClipboardData
nop
mov rcx, rbp
call fcn.10010a2b0
mov rbx, qword [rbp - 0x50]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100223380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
mov rdx, rcx
test rcx, rcx
je 0x100223391
mov rdx, qword [rdx - 8]
test rdx, rdx
jle 0x1002233ec
mov rdx, rcx
test rcx, rcx
je 0x1002233a2
mov rdx, qword [rdx - 8]
cmp edx, 1
jl 0x1002233ec
xor r8d, r8d
nop word [rax + rax]
add r8d, 1
movsxd r9, r8d
movzx r10d, byte [rcx + r9 - 1]
mov r9d, eax
xor r10d, r9d
and r10d, 0xff
mov r9d, eax
shr r9d, 8
and r9d, 0xffffff
lea r11, [0x1002a6090]
xor r9d, dword [r11 + r10*4]
mov eax, r9d
cmp edx, r8d
jg 0x1002233b0
nop
not eax
ret

Function at 0x1002233f0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
and edx, 0xff
mov r8d, dword [rax + 0x18]
mov ecx, r8d
xor edx, ecx
and edx, 0xff
shr r8d, 8
and r8d, 0xffffff
lea rcx, [0x1002a6090]
xor r8d, dword [rcx + rdx*4]
mov dword [rax + 0x18], r8d
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
fisubr word [rdi + 0x1d6a0d7b]
scasd eax, dword [rdi]
invalid
jne 0x1400209a9
idiv dword [rdx + 0x49ff129f]
invalid
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400011b0
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x22c1a45
mov rbx, rcx
jne 0x140001207
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001207
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001207
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x140001207
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000120c
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001214
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x22c1a45
mov rsi, rcx
je 0x140001238
mov eax, 0xc0000001
jmp 0x1400012e5
xor ebx, ebx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x30]
mov edi, ebx
lea ecx, [rbx + 0x42]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400012e3
test rdi, rdi
je 0x140001270
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x42
mov rdi, rax
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x140001260
test rdi, rdi
je 0x1400012e3
mov r8d, dword [rdi]
test r8d, r8d
je 0x1400012d8
lea rcx, [rdi + 8]
mov rdx, qword [rcx]
and rdx, 0xfffffffffffffffe
test byte [rcx], 1
je 0x1400012cd
cmp qword [rcx + 8], 0x200000
jne 0x1400012cd
cmp dword [rcx + 0x10], 0x546e6f43
je 0x1400012f5
inc ebx
add rcx, 0x18
cmp ebx, r8d
jb 0x1400012ae
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rsi + 8]
mov qword [rax], rdx
jmp 0x1400012e3
Function at 0x140001300
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x22c1a45
mov rdi, rcx
jne 0x1400013c5
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x1400013c5
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400013c5
call fcn.1400013dc
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.140001010
test rax, rax
je 0x1400013c5
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov rcx, qword [rdi + 0x10]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
cmp byte [rdi + 0x20], 0
movsxd r8, esi
je 0x1400013a8
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.140001684
jmp 0x1400013c1
lea rdx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x1400013ca
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret