joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007a24
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp + 0x18], 0
jmp 0x140007a45
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0xe3
jae 0x140007ac9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140007a94
mov dword [rsp + 4], 0x9908b0df
jmp 0x140007a9c
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140007a38
jmp 0x140007ad8
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
cmp qword [rsp + 0x18], 0x26f
jae 0x140007b5f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
and eax, 1
test eax, eax
je 0x140007b29
mov dword [rsp + 0xc], 0x9908b0df
jmp 0x140007b31
mov dword [rsp + 0xc], 0
mov eax, dword [rsp + 8]
shr eax, 1
xor eax, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140007acb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x18]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140007ba6
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140007bae
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x30]
xor eax, dword [rdx + rcx + 4]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x18]
mov dword [rcx + rdx*4 + 4], eax
mov rax, qword [rsp + 0x30]
mov dword [rax], 0
add rsp, 0x28
ret
Function at 0x140007bec
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140007c0d
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140007c91
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140007c5c
mov dword [rsp + 4], 0x9908b0df
jmp 0x140007c64
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140007c00
add rsp, 0x18
ret
Function at 0x140008604
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x58
mov byte [rsp + 0x40], 0x49
mov byte [rsp + 0x41], 0xba
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x45], 0
mov byte [rsp + 0x46], 0
mov byte [rsp + 0x47], 0
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
mov byte [rsp + 0x4a], 0x41
mov byte [rsp + 0x4b], 0xff
mov byte [rsp + 0x4c], 0xe2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov eax, 1
imul rax, rax, 2
lea rax, [rsp + rax + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x24], 0xd
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x60]
test eax, eax
je 0x14000872a
cmp qword [rsp + 0x78], 0
je 0x1400086ed
mov rax, qword [rsp + 0x78]
cmp qword [rax + 0x10], 0
je 0x1400086c8
mov rax, qword [rsp + 0x78]
cmp dword [rax + 0x18], 0
jne 0x1400086cf
xor al, al
jmp 0x140008810
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x18]
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140008728
mov eax, dword [rsp + 0x24]
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + 0x20], 1
jmp 0x1400087a0
cmp qword [rsp + 0x78], 0
jne 0x140008739
xor al, al
jmp 0x140008810
mov rax, qword [rsp + 0x78]
cmp qword [rax], 0
je 0x14000874f
mov rax, qword [rsp + 0x78]
cmp dword [rax + 8], 0
jne 0x140008756
xor al, al
jmp 0x140008810
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400087a0
mov eax, dword [rsp + 0x24]
mov r8d, eax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + 0x20], 1
cmp qword [0x1400124b0], 0
jne 0x1400087ce
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400124b0], rax
mov rax, qword [0x1400124b0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [rsp + 0x38]
mov eax, dword [rsp + 0x24]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x28]
mov edx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140008dc8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call fcn.14000aa60
inc rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140008e0e
xor al, al
jmp 0x140008ed1
mov rcx, qword [rsp + 0x60]
call fcn.14000aa60
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call fcn.140002e14
mov qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x60]
call fcn.14000aa60
inc rax
lea r9, [rsp + 0x34]
mov r8d, 0x20
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140008e6e
xor al, al
jmp 0x140008ed1
mov rcx, qword [rsp + 0x60]
call fcn.140008274
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
lea r8, [0x14000a0d4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.14000a07c
mov rcx, qword [rsp + 0x68]
call fcn.140008194
test rax, rax
je 0x140008ec5
mov dword [rsp + 0x30], 1
jmp 0x140008ecd
mov dword [rsp + 0x30], 0
mov al, byte [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x14000b20c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x14000b231
xor eax, eax
jmp 0x14000b3f7
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14000b25a
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000b3f7
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14000b2f9
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140001ce0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140003018
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14000b3e7
mov rcx, qword [rsp + 0x70]
call fcn.140007cb8
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14000b39a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14000b398
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14000b3f7
jmp 0x14000b31f
cmp qword [rsp + 0x20], 0
jbe 0x14000b3e7
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x14000b3fc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14000b435
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000b523
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14000b4cb
cmp qword [rsp + 0x20], 0
jle 0x14000b4cb
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14000b475
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140003018
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x14000b513
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14000b513
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x653927d0
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.65401368
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x654235e8]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x65423308]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x653928bc
lea r12, [0x6541a240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.65401368
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x65423320]
test eax, eax
jne 0x653928e4
mov rcx, rbx
call qword [0x65423300]
cmp rsi, 0x13
jbe 0x65392a90
mov rdx, rdi
mov ecx, ebp
call fcn.65392420
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x6541a258]
test eax, eax
je 0x653928b3
add rax, r12
mov r15, qword [0x65423538]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x653929c0
test dl, dl
je 0x653929c0
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x65392a60
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x65392a40
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x65392a60
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x65392a50
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x65423530]
test eax, eax
je 0x65392a60
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x65392916
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x65392924
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x653929c9
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x653928b3
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.65401378
mov rcx, rbx
call qword [0x65423300]
test r12d, r12d
je 0x653928bc
xor eax, eax
jmp 0x653928d0
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x6539294f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x6539297c
mov rcx, qword [rsp + 0x58]
call fcn.65401320
cmp eax, esi
mov r12d, eax
jae 0x653928b3
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.65401378
jmp 0x65392a20
mov eax, 0xffffffff
jmp 0x653928d0
Function at 0x65392d00
Capabilities:
Get storage device properties

Disassembly:
sub rsp, 0x28
test r9, r9
mov eax, ecx
mov rcx, rdx
jne 0x65392d32
test eax, eax
je 0x65392d50
cmp eax, 1
je 0x65392d70
cmp eax, 2
je 0x65392d80
cmp eax, 3
je 0x65392d90
cmp eax, 4
jne 0x65392d9a
mov edx, r8d
add rsp, 0x28
jmp fcn.653926d0
test eax, eax
je 0x65392d60
cmp eax, 1
jne 0x65392db9
cmp byte [r9], 0x2a
mov edx, r8d
jne 0x65392d90
add rsp, 0x28
jmp fcn.65391f50
mov edx, r8d
add rsp, 0x28
jmp fcn.65392aa0
mov r8d, r8d
mov rcx, r9
add rsp, 0x28
jmp fcn.65392b90
mov edx, r8d
add rsp, 0x28
jmp fcn.65392140
mov edx, r8d
add rsp, 0x28
jmp fcn.653922d0
mov eax, 0xffffffff
add rsp, 0x28
ret
lea r8, str.Unsupported_hardware_type
lea rcx, str..._src_hdinfo.c
mov edx, 0x82
call fcn.65384200
mov eax, 0xffffffff
jmp 0x65392d95
lea r8, str.Unsupported_hardware_type_with_name
lea rcx, str..._src_hdinfo.c
mov edx, 0x6d
call fcn.65384200
mov eax, 0xffffffff
jmp 0x65392d95
Function at 0x65398640
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x6539867a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6540d371]
mov r8d, 0xe9
call fcn.6539d5e0
nop
nop
nop word cs:[rax + rax]
Function at 0x653986a0
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x653988b0
test rdx, rdx
je 0x653988c9
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x653986d4
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x65398830
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x653987f9
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x653987f2
test edx, edx
je 0x6539879d
cmp edx, 1
je 0x6539878b
cmp edx, 2
je 0x6539877f
cmp edx, 3
je 0x65398773
cmp edx, 4
je 0x65398766
cmp edx, 5
je 0x65398759
cmp edx, 6
je 0x6539874d
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x653987f2
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x6539879d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.65397e00
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x65398897
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x65398890
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x65398890
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x65398890
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x65398890
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x65398890
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x65398890
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.65397e00
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x65398705
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6540d371]
mov r8d, 0x106
call fcn.6539d5e0
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6540d37c]
mov r8d, 0x107
call fcn.6539d5e0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x653e0a20
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x653e0a60
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x653e0a52
test byte [rcx + 0xd], 0x10
jne 0x653e0a52
cmp qword [rdx + 0x28], 0
jne 0x653e0a52
cmp qword [rcx + 0x28], rdx
je 0x653e0a63
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x653e0a52
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x653e0ae3
ja 0x653e0b00
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x653e0a52
mov rcx, rbp
call fcn.653e0610
test al, 4
jne 0x653e0a52
mov edx, eax
and edx, 3
cmp edx, 3
je 0x653e0b80
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x653e0bb0
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x653e0bd6
mov rbx, qword [rcx]
test rbx, rbx
je 0x653e0a52
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x653e0a84
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x653e0b13
mov rcx, rbx
jmp 0x653e0acf
cmp edx, 0xcd
jne 0x653e0a8e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x653e0a52
cmp qword [rbx + 0x18], rdi
jne 0x653e0a52
cmp rcx, rbx
mov rax, qword [rbx]
je 0x653e0c10
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x653e0acf
test al, 8
je 0x653e0bf0
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x653e0a52
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x653e0aa8
jmp 0x653e0a52
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x653e0a52
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x653e0acf
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x653e0acf
jmp 0x653e0a52
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x653e0aa8
jmp 0x653e0a52
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x653e0b37