joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1400df098]
lea r10, [0x1400b4370]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3fe0]
add rbx, 0x108
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x401c], edi
jne 0x14001e335
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.14003af80
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x14001e369
inc r8d
test ecx, ecx
je 0x14001e352
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001e357
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14003cd50
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400205e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400df098]
mov edi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x140020641
cmp byte [rbx + 0x43fe], 0
jne 0x140020641
movsx r9d, word [rbx + 0x54de]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000c120
test dil, 1
je 0x140020769
jmp 0x1400206d1
movss xmm1, dword [rbx + 0x39c0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x54de]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400cbe54]
mulss xmm1, dword [0x1400cbe34]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd9c]
addss xmm1, dword [rbx + 0xda0]
mov qword [rbx + 0x410c], rax
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4104], xmm0
mov byte [rbx + 0x412c], 1
movss dword [rbx + 0x4108], xmm1
movss xmm0, dword [rbx + 0x3a1c]
mulss xmm0, dword [0x1400cbd2c]
or dword [rbx + 0x40f0], 0x41
movss dword [rbx + 0x4150], xmm0
call fcn.14000c120
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140020721
lea r11, [0x1400b4370]
cmp r9b, 0x23
jne 0x140020704
cmp byte [r8], r9b
jne 0x140020704
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400206f1
not ecx
call fcn.1400176b0
test rax, rax
je 0x140020769
cmp byte [rax + 0xcb], 0
je 0x140020769
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, 0x10
movsx r9d, word [rbx + 0x54de]
call fcn.14000c120
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14001a400
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400afe50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140025bf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdx, qword [0x1400df098]
xor r15d, r15d
mov ebp, ecx
mov rbx, rdx
mov r14d, r15d
mov rsi, qword [rdx + 0x3fe0]
test cl, 0x10
jne 0x140025d9b
mov edi, dword [rdx + 0x40b0]
test edi, edi
je 0x140025c70
cmp dword [rdx + 0x4034], edi
jne 0x140025d94
mov eax, dword [rdx + 0x407c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdx + 0xda4], r14b
je 0x140025d94
cmp byte [rsi + 0xd0], r14b
jne 0x140025d94
jmp 0x140025d12
cmp byte [rdx + 0xda4], r14b
je 0x140025d94
cmp byte [rsi + 0xd0], r14b
jne 0x140025d94
test byte [rdx + 0x40b8], 1
jne 0x140025cad
cmp dword [rdx + 0x4034], r14d
je 0x140025d94
cmp qword [rdx + 0x4070], rsi
jne 0x140025d94
test bpl, 8
je 0x140025d94
add rdx, 0x40bc
mov rcx, rsi
call fcn.140011090
mov edx, eax
mov dword [rbx + 0x40b0], eax
lea rcx, [rbx + 0x40bc]
mov edi, eax
call fcn.140011520
movzx r14d, al
test al, al
je 0x140025cff
cmp byte [rbx + 0x36c0], r15b
je 0x140025cff
mov rdx, rsi
mov ecx, edi
call fcn.140011250
mov rcx, rsi
call fcn.14001d4e0
cmp dword [rbx + 0x4034], edi
jne 0x140025d94
mov rdx, qword [0x1400df098]
mov byte [rbx + 0x4041], r14b
mov rax, qword [rsi + 0x110]
movsxd rcx, dword [rsi + 0x108]
mov r14d, dword [rax + rcx*4 - 4]
movsxd rax, r15d
cmp byte [rax + rdx + 0xda4], 0
jne 0x140025d3d
xor cl, cl
jmp 0x140025d55
movss xmm1, dword [rdx + 0x38]
movss xmm0, dword [rdx + rax*4 + 0x3740]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae cl
movdqa xmm0, xmmword [0x1400cc210]
mov qword [rdx + 0x4048], 0xffffffffffffffff
movups xmmword [rdx + 0x4050], xmm0
movd dword [rdx + 0x4060], xmm0
cmp byte [rdx + 0x42ad], 0
mov word [rdx + 0x42c4], 0
setne al
mov byte [rdx + 0x42ac], al
test cl, cl
jne 0x140025de8
xor al, al
jmp 0x140025e86
mov r9d, 0xffffffff
lea rdx, [0x1400b9429]
mov edi, r9d
lea r10, [0x1400b4370]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140025dc8
cmp byte [rdx], r8b
jne 0x140025dc8
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140025db5
not edi
cmp byte [rbx + 0x43fc], 0
jne 0x140025e26
call fcn.140025b30
mov dword [rbx + 0x441c], edi
mov dword [rbx + 0x4420], r14d
mov byte [rbx + 0x43fc], 1
mov dword [rbx + 0x4400], ebp
mov dword [rbx + 0x4408], r15d
cmp edi, dword [rbx + 0x4034]
jne 0x140025e26
mov byte [rbx + 0x4042], 1
mov eax, dword [rbx + 0x3f60]
mov dword [rbx + 0x4404], eax
mov byte [rbx + 0x43fd], 1
test bpl, 1
jne 0x140025e77
xor ecx, ecx
call fcn.1400205e0
cmp dword [rbx + 0x4470], 0
je 0x140025e77
test dword [rbx + 0x4464], 0x1000
je 0x140025e77
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xd0], 1
mov byte [rax + 0xd2], 1
mov byte [rax + 0xec], 1
test bpl, 0x12
jne 0x140025e84
and dword [rbx + 0x40b8], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400262b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x55d0], 0
lea rbx, [rcx + 0x55d8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140026357
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002630a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14003cae0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000d0e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x55d0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x55e0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400df090]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002635f
mov rcx, rbx
call fcn.14000d0e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140026a90
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140026ae2
lea r11, [0x1400b4370]
cmp r9b, 0x23
jne 0x140026ac5
cmp byte [r8], r9b
jne 0x140026ac5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140026ab2
mov r11, qword [0x1400df098]
mov r10, qword [r11 + 0x5598]
test r10, r10
je 0x140026b29
lea r9, [r10 + 4]
test r9, r9
je 0x140026b29
not eax
cmp dword [r9], eax
je 0x140026b32
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x5590]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140026b00
mov rcx, rbx
pop rbx
jmp fcn.1400269a0
mov rax, r9
pop rbx
ret
Function at 0x140084960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x190]
mov r10, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x14008499c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0x118]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0x130], xmm0
subss xmm0, dword [r9 + 0x48]
movss dword [r9 + 0x11c], xmm1
subss xmm0, dword [r9 + 0x158]
movss dword [r9 + 0x15c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x150], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x16c], eax
movss dword [r9 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1d4], eax
cmp byte [rbx + 0x5a], 0
jne 0x140084a37
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0x11c], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0xd0], al
cmp byte [rbx + 0x60], 0
je 0x140084a5d
mov rax, qword [0x1400df098]
xor ecx, ecx
mov dword [rax + 0x40b0], ecx
mov dword [rax + 0x40b8], ecx
test dword [r10 + 4], 0x100000
je 0x140084a72
mov r8d, 2
jmp 0x140084af2
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2b8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2b8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x2b8]
mov rcx, qword [r10 + 0x1a8]
call fcn.140076890
mov rdi, qword [0x1400df098]
cmp byte [rdi + 0x55c4], 0
je 0x140084b37
cmp byte [rbx + 0x60], 0
jne 0x140084b37
xor r8d, r8d
lea rdx, [0x1400cb140]
mov rcx, rsi
call fcn.1400263c0
mov dword [rdi + 0x55f8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140086fb0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1400df098]
mov rdx, qword [rax + 0x44b8]
cmp ecx, 0xffffffff
jne 0x140086fca
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x140087049
mov r10d, dword [rdx]
lea r8, [0x1400cb131]
movzx eax, word [rdx + 0x80]
lea r11, [0x1400b4370]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x140087023
cmp byte [r8], r9b
jne 0x140087023
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140087010
not ecx
xor edx, edx
jmp fcn.140020830
ret
Function at 0x1400a7990
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov r11, qword [0x1400df098]
mov r8, rcx
mov rbx, qword [r11 + 0x4520]
test rbx, rbx
je 0x1400a7a1e
test dword [rbx + 0x10], 0x100000
jne 0x1400a7a1e
mov rdx, rcx
mov rcx, qword [r11 + 0x3fe0]
call fcn.140010d30
test eax, eax
je 0x1400a7aca
movsxd rcx, dword [rbx]
xor r8d, r8d
test ecx, ecx
jle 0x1400a7aca
mov r10, qword [rbx + 8]
mov r9, rcx
mov rcx, r10
mov edx, r8d
cmp dword [rcx], eax
je 0x1400a7a00
inc r8d
inc rdx
add rcx, 0x30
cmp rdx, r9
jl 0x1400a79e7
add rsp, 0x20
pop rbx
ret
movsxd rax, r8d
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, r10
je 0x1400a7aca
mov byte [rcx + 0x2c], 1
add rsp, 0x20
pop rbx
ret
movzx r9d, byte [r8]
mov r10d, 0xffffffff
inc r8
mov ecx, r10d
test r9b, r9b
je 0x1400a7a6f
lea rbx, [0x1400b4370]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400a7a53
cmp byte [r8], r9b
jne 0x1400a7a53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400a7a40
not ecx
call fcn.1400176b0
mov rbx, rax
test rax, rax
je 0x1400a7aca
test byte [rax + 0x3f9], 1
je 0x1400a7aca
mov rcx, qword [rax + 0x418]
test rcx, rcx
je 0x1400a7aca
mov edx, dword [rax + 0x90]
cmp dword [r11 + 0x4034], edx
jne 0x1400a7aa9
mov dword [r11 + 0x4038], edx
cmp dword [r11 + 0x4080], edx
jne 0x1400a7aba
mov byte [r11 + 0x4084], 1
mov rcx, qword [rcx + 0x40]
call fcn.1400a6050
or byte [rbx + 0x3f9], 8
add rsp, 0x20
pop rbx
ret
Function at 0x1400af410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400af456
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400af446
cmp byte [rax], cl
jne 0x1400af456
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400af437
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400af5ba
cmp byte [r8 + 1], dl
je 0x1400af5ba
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400af492
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400af4ba
sub dl, 0x61
cmp dl, 0x19
ja 0x1400af4ac
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400af4ba
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400af475
jmp 0x1400af4bd
inc r9
cmp r8, r9
jae 0x1400af4ef
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400af4e4
bt rdx, rax
jb 0x1400af4ea
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400af4d0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14000c120
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400af528
nop
inc rcx
cmp byte [rcx], 0x20
je 0x1400af520
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400af5a8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400af543
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400af559
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400af596
movss xmm2, dword [0x1400cbe3c]
cmp al, 0x39
ja 0x1400af596
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400af570
cmp r9b, 0x2d
jne 0x1400af5b5
xorps xmm1, xmmword [0x1400cc1e0]
movaps xmm0, xmm1
jmp 0x1400af5bd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400af5bd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400afe50
add rsp, 0x90
pop rbx
ret
Function at 0x1400afc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400afc46
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400afc36
cmp byte [rax], cl
jne 0x1400afc46
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400afc27
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400afda4
cmp byte [r8 + 1], dl
je 0x1400afda4
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400afc82
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400afcaa
sub dl, 0x61
cmp dl, 0x19
ja 0x1400afc9c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400afcaa
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400afc65
jmp 0x1400afcad
inc r9
cmp r8, r9
jae 0x1400afcdf
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400afcd4
bt rdx, rax
jb 0x1400afcda
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400afcc0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.14000c120
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400afd18
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400afd10
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400afd96
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400afd33
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400afd49
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400afd84
movsd xmm2, qword [0x1400cbde0]
cmp al, 0x39
ja 0x1400afd84
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400afd60
cmp r9b, 0x2d
jne 0x1400afd9f
xorps xmm1, xmmword [0x1400cc1d0]
movaps xmm0, xmm1
jmp 0x1400afda7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400afda7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400afe50
add rsp, 0x90
pop rbx
ret

Function at 0x1400b0b1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b0b66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b0b66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b0b66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b0b66
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b0b66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b0b68
xor al, al
add rsp, 0x28
ret
Function at 0x140002d70
Capabilities:
Get session user name

Disassembly:
push rbp
sub rsp, 0x3b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x328], 0xfffffffffffffffe
mov qword [rbp - 0x40], rcx
mov rax, rcx
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x320], rcx
mov dword [rbp + 0x10c], 0x101
mov byte [rbp + 0x10b], 0
lea rdx, [0x14005b82c]
call fcn.140004bd0
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x10c]
call rax
mov dword [rbp - 0x2c], eax
jmp 0x140002dd9
mov eax, dword [rbp - 0x2c]
cmp eax, 0
jne 0x140002dff
mov rcx, qword [rbp - 0x40]
lea rdx, str.null
call fcn.140010560
jmp 0x140002dfa
jmp 0x140002e6a
mov byte [rbp - 1], 0x20
mov rax, rsp
lea rcx, [rbp - 1]
mov qword [rax + 0x30], rcx
mov rcx, rbp
mov qword [rax + 0x20], rcx
mov qword [rax + 0x38], 0
mov dword [rax + 0x28], 0x101
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
lea r8, [rbp + 0x110]
mov r9d, 0xffffffff
mov ecx, edx
call rax
jmp 0x140002e43
lea rcx, [rbp - 0x28]
mov rdx, rbp
call fcn.140004bd0
jmp 0x140002e54
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.14000c420
lea rcx, [rbp - 0x28]
call fcn.140004f90
mov byte [rbp + 0x10b], 1
test byte [rbp + 0x10b], 1
jne 0x140002e87
mov rcx, qword [rbp - 0x40]
call fcn.140004f90
mov rax, qword [rbp - 0x38]
add rsp, 0x3b0
pop rbp
ret
Function at 0x14001bb80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x78], 0
jg 0x14001bbbd
mov qword [rsp + 0x80], 0
jmp 0x14001bd89
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x68], 0
je 0x14001bbee
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
call fcn.14001c8f0
mov qword [rsp + 0x80], rax
jmp 0x14001bd89
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
call fcn.14001cc60
mov qword [rsp + 0x50], rax
xor eax, eax
cmp rax, qword [rsp + 0x50]
jae 0x14001bc8d
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.140005f20
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
call fcn.14001ccb0
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.1400066a0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
sub rax, rdx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov edx, eax
call fcn.14001ccd0
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x80], 0
je 0x14001bd77
mov rcx, qword [rsp + 0x30]
call fcn.14001b000
mov qword [rsp + 0x40], 0xfff
mov eax, 0xfff
cmp rax, qword [rsp + 0x60]
jae 0x14001bd35
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov rcx, qword [rsp + 0x70]
mov edx, 1
mov r8d, 0xfff
call fcn.14003f860
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x38], 0xfff
je 0x14001bd30
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
jmp 0x14001bd89
jmp 0x14001bcb3
xor eax, eax
cmp rax, qword [rsp + 0x60]
jae 0x14001bd72
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov edx, 1
call fcn.14003f860
mov rcx, rax
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x14001bd77
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
add rsp, 0x88
ret
Function at 0x140029ca0
Capabilities:
Get hostname

Disassembly:
push rbp
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rbp - 0x40], rcx
mov rax, rcx
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x40], rcx
mov dword [rbp + 0x1c], 0x10
mov byte [rbp + 0x1b], 0
lea rdx, [0x14005b82c]
call fcn.140004bd0
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0x1c]
call rax
mov dword [rbp - 0x2c], eax
jmp 0x140029cf7
mov eax, dword [rbp - 0x2c]
cmp eax, 0
jne 0x140029d1d
mov rcx, qword [rbp - 0x40]
lea rdx, str.null
call fcn.140010560
jmp 0x140029d18
jmp 0x140029d85
mov byte [rbp - 1], 0x20
mov rax, rsp
lea rcx, [rbp - 1]
mov qword [rax + 0x30], rcx
mov rcx, rbp
mov qword [rax + 0x20], rcx
mov qword [rax + 0x38], 0
mov dword [rax + 0x28], 0x10
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
lea r8, [rbp + 0x20]
mov r9d, 0xffffffff
mov ecx, edx
call rax
jmp 0x140029d5e
lea rcx, [rbp - 0x28]
mov rdx, rbp
call fcn.140004bd0
jmp 0x140029d6f
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.14000c420
lea rcx, [rbp - 0x28]
call fcn.140004f90
mov byte [rbp + 0x1b], 1
test byte [rbp + 0x1b], 1
jne 0x140029d9c
mov rcx, qword [rbp - 0x40]
call fcn.140004f90
mov rax, qword [rbp - 0x38]
add rsp, 0xd0
pop rbp
ret

Function at 0x140029de0
Capabilities:
Get session user name

Disassembly:
push rbp
sub rsp, 0x3b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x328], 0xfffffffffffffffe
mov qword [rbp - 0x40], rcx
mov rax, rcx
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x320], rcx
mov dword [rbp + 0x10c], 0x101
mov byte [rbp + 0x10b], 0
lea rdx, [0x14005b82c]
call fcn.140004bd0
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x10c]
call rax
mov dword [rbp - 0x2c], eax
jmp 0x140029e49
mov eax, dword [rbp - 0x2c]
cmp eax, 0
jne 0x140029e6f
mov rcx, qword [rbp - 0x40]
lea rdx, str.null
call fcn.140010560
jmp 0x140029e6a
jmp 0x140029eda
mov byte [rbp - 1], 0x20
mov rax, rsp
lea rcx, [rbp - 1]
mov qword [rax + 0x30], rcx
mov rcx, rbp
mov qword [rax + 0x20], rcx
mov qword [rax + 0x38], 0
mov dword [rax + 0x28], 0x101
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
lea r8, [rbp + 0x110]
mov r9d, 0xffffffff
mov ecx, edx
call rax
jmp 0x140029eb3
lea rcx, [rbp - 0x28]
mov rdx, rbp
call fcn.140004bd0
jmp 0x140029ec4
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x28]
call fcn.14000c420
lea rcx, [rbp - 0x28]
call fcn.140004f90
mov byte [rbp + 0x10b], 1
test byte [rbp + 0x10b], 1
jne 0x140029ef7
mov rcx, qword [rbp - 0x40]
call fcn.140004f90
mov rax, qword [rbp - 0x38]
add rsp, 0x3b0
pop rbp
ret