joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010650
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x40
call fcn.180045050
sub rsp, rax
mov rsi, qword [rdx]
lea r14, [rcx + 0x60]
mov rbx, rdx
mov edx, dword [r14]
mov rdi, rcx
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.180003c30
test rax, rax
je 0x1800106d3
mov rax, qword [rax]
test rax, rax
je 0x1800106d3
mov rax, qword [rax + 0x10]
cmp byte [rax + 4], 0
je 0x1800106c1
cmp byte [rbx + 0x1c], 0
je 0x1800106c1
mov edx, 1
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi + 0xf8]
lea r8, [rsp + 0x28]
xor r9d, r9d
call fcn.180003c30
test rax, rax
je 0x1800106f5
mov rax, qword [rax]
mov rdi, qword [rax + 0x10]
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdi + 8]
call qword [0x1800ad9b0]
cmp eax, 0x1f4
je 0x18001086e
test eax, eax
je 0x18001072d
mov ecx, eax
call fcn.180003860
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x18
call fcn.1800125e0
test rax, rax
je 0x18001087b
mov edx, dword [rbx + 0x18]
mov r9, qword [rsp + 0x38]
movzx r8d, byte [rbx + 0x1c]
mov dword [rax], edx
lea rdx, [rsp + 0x28]
mov rcx, r14
mov byte [rax + 4], r8b
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.180010f00
mov ecx, dword [rdi + 0x60]
test ecx, ecx
jne 0x180010790
lea edx, [rcx + 1]
lea rcx, [rdi + 0x60]
call fcn.180011670
mov ecx, dword [rdi + 0x60]
test ecx, ecx
je 0x18001087b
mov r8, qword [rdi + 0x70]
test ecx, ecx
jne 0x1800107a3
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
jmp 0x180010832
movzx eax, byte [rsp + 0x21]
movzx ebp, sil
xor edx, edx
xor ebp, 0x811c9dc5
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x22]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x23]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x24]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x25]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x26]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x27]
imul ebp, ebp, 0x1000193
xor ebp, eax
imul ebp, ebp, 0x1000193
mov eax, ebp
div ecx
mov rax, qword [r8 + rdx*8]
lea rbx, [r8 + rdx*8]
test rax, rax
je 0x180010832
cmp qword [rax + 8], rsi
je 0x180010832
mov rbx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180010821
cmp qword [rbx], 0
jne 0x18001086e
mov ecx, 0x18
call fcn.1800125e0
test rax, rax
je 0x180010855
mov qword [rax], 0
mov qword [rax + 8], rsi
mov dword [rax + 0x10], ebp
mov qword [rbx], rax
test rax, rax
je 0x18001087b
inc qword [rdi + 0x68]
mov rdx, qword [rdi + 0x68]
lea rcx, [rdi + 0x60]
call fcn.180011670
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 2
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800131f0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x68
call fcn.180045050
sub rsp, rax
lea rax, [rcx + 0x30]
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rbx, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov qword [rsp + 0x48], rax
call fcn.1800124f0
mov r14, qword [rbx + 0x10]
mov eax, dword [rbx]
lea rax, [r14 + rax*8]
mov r12d, edi
mov qword [rsp + 0x50], rax
cmp r14, rax
je 0x180013259
cmp qword [r14], rdi
jne 0x180013256
add r14, 8
cmp r14, rax
jne 0x180013243
jmp 0x180013430
mov r12, qword [r14]
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x60], r15
mov r15d, dword [rsp + 0x20]
nop dword [rax + rax]
test r12, r12
je 0x180013423
mov rbx, qword [r12 + 8]
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x1800133f0
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbp
call fcn.180010e80
test eax, eax
jne 0x180013421
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x1800133de
mov ecx, dword [rsi + 0x58]
mov rbp, qword [r13 + 8]
mov qword [rsp + 0x28], rbp
test ecx, ecx
jne 0x1800132e0
lea edx, [rax + 1]
lea rcx, [rsi + 0x58]
call fcn.1800139a0
mov ecx, dword [rsi + 0x58]
test ecx, ecx
je 0x18001341a
mov r8, qword [rsi + 0x68]
test ecx, ecx
je 0x180013391
movzx eax, byte [rsp + 0x29]
movzx r15d, bpl
xor edx, edx
xor r15d, 0x811c9dc5
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2a]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2b]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2c]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2d]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2e]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2f]
imul r15d, r15d, 0x1000193
xor r15d, eax
imul r15d, r15d, 0x1000193
mov eax, r15d
div ecx
mov rax, qword [r8 + rdx*8]
lea rdi, [r8 + rdx*8]
test rax, rax
je 0x180013391
nop dword [rax + rax]
cmp qword [rax + 8], rbp
je 0x180013391
mov rdi, rax
mov rax, qword [rax]
test rax, rax
jne 0x180013380
cmp qword [rdi], 0
jne 0x1800133d2
mov ecx, 0x20
call fcn.1800125e0
test rax, rax
je 0x1800133b9
mov qword [rax], 0
mov qword [rax + 8], rbp
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r15d
mov qword [rdi], rax
test rax, rax
je 0x18001341a
inc qword [rsi + 0x60]
mov rdx, qword [rsi + 0x60]
lea rcx, [rsi + 0x58]
call fcn.1800139a0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
xor edi, edi
mov rbx, qword [rbx + 0x50]
test rbx, rbx
jne 0x180013290
mov rax, qword [rsp + 0x50]
mov r12, qword [r12]
test r12, r12
jne 0x180013279
nop dword [rax]
add r14, 8
cmp r14, rax
je 0x180013270
mov r12, qword [r14]
test r12, r12
je 0x180013400
jmp 0x180013270
mov edi, 2
jmp 0x180013423
mov edi, eax
mov r13, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.1800125c0
mov eax, edi
add rsp, 0x68
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180015210
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18009e088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.1800152d0
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.180014fb0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800445b0
add rsp, 0xb0
pop rbx
ret
Function at 0x180030540
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
test ecx, ecx
jle 0x180030624
mov qword [rsp + 0x40], rbx
movsxd rbx, ecx
cmp ecx, 0x64
jle 0x1800305b4
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x18007357c]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x1800305d7
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x140002910
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000296d
lea rbx, [0x140075fd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002954
cmp r10, 2
jb 0x140002954
cmp byte [r9], r8b
jne 0x140002954
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002930
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400029af
lea rbx, [0x140075fd0]
cmp r8b, 0x23
jne 0x140002993
cmp byte [r9], r8b
jne 0x140002993
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002980
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002b0a
mov qword [r8], 0
lea rdx, [0x140075dac]
call fcn.1400029c0
mov rbx, rax
test rax, rax
jne 0x140002b2a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002c01
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002c01
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002c01
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002c01
cmp rdi, 0xffffffffffffffff
je 0x140002c01
mov rax, qword [0x1400ab088]
test rax, rax
je 0x140002b9e
inc dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002c01
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002bee
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400ab088]
test rax, rax
je 0x140002be3
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002c0a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002bfc
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002c0c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000ef10
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400ab088]
lea rdx, [0x140075fd0]
mov r8, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14000f011
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14000effd
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000f002
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140017060
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400ab088]
lea rdx, [0x140075fd0]
mov r8d, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14000f0e7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14000f0d3
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000f0d8
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140017060
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010090
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400aa010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400ab088]
mov edi, edx
cmp byte [rbx + 0x1f4d], 0
jne 0x1400100f0
cmp byte [rbx + 0x1f4e], 0
jne 0x1400100f0
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002890
test dil, 1
je 0x14001020e
jmp 0x140010178
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2ff8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14009cdd4]
mulss xmm1, dword [0x14009cdb0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cc8], rax
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc0], xmm0
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x14009cce0]
or dword [rbx + 0x1cb0], 0x41
movss dword [rbx + 0x1d10], xmm0
call fcn.140002890
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400101c8
lea r11, [0x140075fd0]
cmp r9b, 0x23
jne 0x1400101ab
cmp byte [r8], r9b
jne 0x1400101ab
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010198
not ecx
call fcn.140009960
test rax, rax
je 0x14001020e
cmp byte [rax + 0x8e], 0
je 0x14001020e
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.140002890
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000bfc0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140070f60
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140015030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3098], 0
lea rbx, [rcx + 0x30a0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400150d7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001508a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140016ea0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400031c0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3098]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x30a8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400ab080]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400150df
mov rcx, rbx
call fcn.1400031c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14003cd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400aa010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14003cd56
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14003cd46
cmp byte [rax], cl
jne 0x14003cd56
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14003cd37
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14003ceba
cmp byte [r8 + 1], dl
je 0x14003ceba
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003cd92
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14003cdba
sub dl, 0x61
cmp dl, 0x19
ja 0x14003cdac
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14003cdba
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14003cd75
jmp 0x14003cdbd
inc r9
cmp r8, r9
jae 0x14003cdef
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14003cde4
bt rdx, rax
jb 0x14003cdea
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14003cdd0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140002890
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14003ce28
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14003ce20
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14003cea8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003ce43
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14003ce59
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14003ce96
movss xmm2, dword [0x14009cdbc]
cmp al, 0x39
ja 0x14003ce96
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14003ce70
cmp r9b, 0x2d
jne 0x14003ceb5
xorps xmm1, xmmword [0x14009d270]
movaps xmm0, xmm1
jmp 0x14003cebd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003cebd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140070f60
add rsp, 0x90
pop rbx
ret
Function at 0x14003cee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400aa010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14003cf26
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14003cf16
cmp byte [rax], cl
jne 0x14003cf26
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14003cf07
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14003d084
cmp byte [r8 + 1], dl
je 0x14003d084
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003cf62
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14003cf8a
sub dl, 0x61
cmp dl, 0x19
ja 0x14003cf7c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14003cf8a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14003cf45
jmp 0x14003cf8d
inc r9
cmp r8, r9
jae 0x14003cfbf
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14003cfb4
bt rdx, rax
jb 0x14003cfba
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14003cfa0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002890
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14003cff8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14003cff0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14003d076
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003d013
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14003d029
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14003d064
movsd xmm2, qword [0x14009cd60]
cmp al, 0x39
ja 0x14003d064
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14003d040
cmp r9b, 0x2d
jne 0x14003d07f
xorps xmm1, xmmword [0x14009d260]
movaps xmm0, xmm1
jmp 0x14003d087
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003d087
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140070f60
add rsp, 0x90
pop rbx
ret
Function at 0x140053480
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400aa010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400534fd
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x1400534f4
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140053520
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x1400534d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140070f60
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400534ff

Function at 0x140053530
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400aa010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140053591
mov r8d, 4
mov qword [rsp + 0x68], rsi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1400535a9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140070f60
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x14005358a
cmp dword [rsp + 0x24], 4
jne 0x14005358a
mov al, 1
jmp 0x14005358c

Function at 0x1400536c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400536f6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
pop rbx
ret