joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800326c0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180046040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800327eb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800327e2
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x1800327c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800327c4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800327c4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180032782
mov rcx, qword [0x180046b18]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x1800327e2
jmp 0x1800327b7
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x1800327b7
mov rcx, qword [0x180046b18]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800327e2
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180032730
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180032843
cmp dword [rbx + 0xc], esi
jbe 0x180032843
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18003283c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180032510
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180032800
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180034790
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180032870
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180046040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180046ce0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800328e3
mov eax, 0xa
jmp 0x180032976
test esi, esi
je 0x180032905
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180032928
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180032928
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180032921
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180032928
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180034790
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800329a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180046cec]
mov ebx, edi
test ecx, ecx
je 0x180032adb
mov rax, qword [0x180046ce0]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800329f8
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800329d0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x180032adb
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.1800326c0
mov r8d, dword [0x180046cec]
cmp ebx, r8d
jae 0x180032a68
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180046ce0]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180032a61
mov edx, esi
mov ecx, ebx
call fcn.180032870
mov edi, eax
test eax, eax
jne 0x180032a68
mov r8d, dword [0x180046cec]
inc ebx
cmp ebx, r8d
jb 0x180032a30
cmp qword [rsp + 0x20], 0
je 0x180032adb
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180032ac7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180032ab8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180032a90
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180046b18]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180032e50
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180046b10], ebp
je 0x180032ea7
cmp rbx, 0x20
jae 0x180032e90
xor ecx, ecx
jmp 0x180032e92
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180046b10], ebp
jne 0x180032e86
cmp qword [0x180046b18], r15
je 0x180032fa1
test rdi, rdi
jne 0x180032ec7
mov ecx, esi
call fcn.1800329a0
mov ebp, eax
jmp 0x180032fa6
mov ecx, dword [0x180046cec]
mov ebx, r15d
test ecx, ecx
je 0x180032eef
mov r8, qword [0x180046ce0]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180032ef9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180032ee0
mov ebp, 4
jmp 0x180032fa6
cmp ebx, 0xffffffff
je 0x180032eef
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x180032f98
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800326c0
mov edx, esi
mov ecx, ebx
call fcn.180032870
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180032fa6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180032f82
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180032f78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180032f50
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180046b18]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180032fa6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180032fa6
mov ebp, 2
xchg dword [0x180046b10], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180034700
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
test edx, edx
je 0x180034742
cmp edx, 1
jne 0x18003476c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x1800346a0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp dword [0x180046c30], 0
je 0x18003476c
call fcn.180032fd0
mov rcx, qword [0x180046c28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x180046c28], rax
mov dword [0x180046c30], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140097645
Capabilities:
Hide graphical window

Disassembly:
jmp 0x14009f010
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x60]
lea rcx, [0x14024210d]
call fcn.1400994b8
mov dword [0x14022bf90], 0x50
mov dword [0x14022bf94], 0x40
lea rax, [0x1400985b8]
mov qword [0x14022bf98], rax
mov dword [0x14022bfa0], 0
mov dword [0x14022bfa4], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x14022bfa8], rax
mov qword [0x14022bfb0], 0
mov qword [0x14022bfb8], 0
mov qword [0x14022bfc0], 0
mov qword [0x14022bfc8], 0
lea rax, str.class001
mov qword [0x14022bfd0], rax
mov qword [0x14022bfd8], 0
lea rcx, [0x14022bf90]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], 0
mov rax, qword [0x14022bfa8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x258
mov dword [rsp + 0x30], 0x320
mov dword [rsp + 0x28], 0x64
mov dword [rsp + 0x20], 0x64
mov r9d, 0x80000000
mov r8, qword [rbp + 0xe0]
lea rdx, str.class001
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14022bf80], rax
mov edx, 0xa
mov rcx, qword [0x14022bf80]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14022bf80]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14009774e
Capabilities:
Set console window title

Disassembly:
jmp 0x1400a2f10
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x20]
lea rcx, [0x14024223e]
call fcn.1400994b8
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xd8], rax
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xe0], rax
mov r9, qword [rbp + 0xd8]
lea r8, [0x1401d066c]
lea rdx, str.CONOUT_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_freopen_s]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xd8], rax
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xe0], rax
mov r9, qword [rbp + 0xd8]
lea r8, [0x1401d067c]
lea rdx, str.CONIN_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xd8], rax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov qword [rbp + 0xe0], rax
mov r9, qword [rbp + 0xd8]
lea r8, [0x1401d066c]
lea rdx, str.CONOUT_
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_freopen_s]
lea rcx, str.Debug_Console
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
lea rsp, [rbp + 0xf8]
pop rdi
pop rbp
ret

Function at 0x140098455
Capabilities:
Terminate process

Disassembly:
jmp 0x1401c2eb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140098734
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400c9ff0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402422ed]
call fcn.1400994b8
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14009889c
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400c9f80
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402422ed]
call fcn.1400994b8
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400988b0
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400cab70
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1402422ed]
call fcn.1400994b8
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1401d0700]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400cacb5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400cac09
mov dword [rbp + 0x160], 1
jmp 0x1400cac13
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400cacb0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400cac8a
cmp qword [rbp + 0x198], 2
jb 0x1400cac8a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400cac8a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400cac8a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400cabd4
jmp 0x1400cad4f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400cad4f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400cad26
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400cad26
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400cad26
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400cacb5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400989aa
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401c51a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401c51c0
xor al, al
jmp 0x1401c5241
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401c51d3
xor al, al
jmp 0x1401c5241
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401c51fd
xor al, al
jmp 0x1401c5241
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401c5211
xor al, al
jmp 0x1401c5241
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401c5223
xor al, al
jmp 0x1401c5241
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401c523f
xor al, al
jmp 0x1401c5241
mov al, 1
add rsp, 0x38
ret
Function at 0x140099229
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400caa50
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1402422ed]
call fcn.1400994b8
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1401d0700]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400caacf
mov dword [rbp + 0x120], 1
jmp 0x1400caad9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400cab22
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400caa9a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400b7e00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x1400b7e2b
xor ecx, ecx
lea r9, [0x14017bec0]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rcx
cmp r8, rcx
jne 0x1400b7e10
ret

Function at 0x1400b93d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b9422
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b9422
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b9422
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b9422
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b9422
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b9424
xor al, al
add rsp, 0x28
ret

Function at 0x1400b9870
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400b98e8
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400b98e8
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400b98e8
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400b98dc
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400b98fa
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400b98ca
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400b98ea

Function at 0x1400c8548
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400c857f
call fcn.1400cb874
mov dword [rax], 0x16
call fcn.1400cd20c
xor eax, eax
jmp 0x1400c860d
mov rdx, r9
mov rcx, r8
call fcn.1400c8630
mov rbx, rax
test rax, rax
je 0x1400c860a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400c86a0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400c85f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400cb8b4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400c85de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400c85ed
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400700d0
jmp 0x1400c860a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400c8607
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400c8774
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c88bc
Function at 0x1400e0dcc
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x1400e0dd4
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
xor r12d, r12d
mov qword [rsp + 0x50], rdx
mov r15, rcx
test rdx, rdx
jne 0x1400e0e2c
call fcn.1400cb874
lea ebx, [r12 + 0x16]
mov dword [rax], ebx
call fcn.1400cd20c
mov eax, ebx
jmp 0x1400e1184
xorps xmm0, xmm0
mov qword [rdx], r12
mov rax, qword [rcx]
movdqu xmmword [rsp + 0x30], xmm0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], r12
test rax, rax
je 0x1400e105c
lea rdx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x3f002a
mov rcx, rax
mov word [rbp + 0x1b4], r12w
movabs rbx, 0x200000000801
call fcn.1400df50c
mov r14, qword [r15]
mov rcx, rax
test rax, rax
jne 0x1400e0eb4
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1400e11c4
mov rdi, qword [rsp + 0x30]
mov esi, eax
test eax, eax
jne 0x1400e1005
mov rsi, qword [rsp + 0x38]
jmp 0x1400e0ff9
cmp rax, r14
je 0x1400e0ed8
movzx eax, word [rcx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x1400e0ecf
movzx eax, ax
bt rbx, rax
jb 0x1400e0ed8
sub rcx, 2
cmp rcx, r14
jne 0x1400e0eb9
movzx edx, word [rcx]
cmp dx, 0x3a
jne 0x1400e0eea
lea rax, [r14 + 2]
cmp rcx, rax
jne 0x1400e0f39
sub dx, 0x2f
cmp dx, 0x2d
ja 0x1400e0eff
movzx eax, dx
bt rbx, rax
mov al, 1
jb 0x1400e0f02
mov al, r12b
sub rcx, r14
mov dword [rsp + 0x28], r12d
sar rcx, 1
lea r8, [rsp + 0x60]
inc rcx
mov qword [rsp + 0x20], r12
neg al
sbb r13, r13
xor r9d, r9d
and r13, rcx
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e0f65
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, r12
mov rcx, r14
call fcn.1400e11c4
mov esi, eax
test eax, eax
jne 0x1400e1034
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
jmp 0x1400e0ff9
sub rsi, rdi
sar rsi, 3
mov r12, rsi
xor edi, edi
cmp word [rbp - 0x74], 0x2e
jne 0x1400e0f8d
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x1400e0fab
cmp ax, 0x2e
jne 0x1400e0f8d
cmp word [rbp - 0x70], di
je 0x1400e0fab
lea r9, [rsp + 0x30]
mov r8, r13
mov rdx, r14
lea rcx, [rbp - 0x74]
call fcn.1400e11c4
mov esi, eax
test eax, eax
jne 0x1400e102b
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400e0f71
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rdx, rsi
sub rdx, rdi
sar rdx, 3
cmp r12, rdx
je 0x1400e0fed
sub rdx, r12
lea rcx, [rdi + r12*8]
lea r9, [0x1400e1350]
lea r8d, [rax + 8]
call fcn.1400d4cb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r12d, r12d
add r15, 8
mov rax, qword [r15]
jmp 0x1400e0e4a
mov rbx, rdi
invalid
invalid