joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33410
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x0003b5d0]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x335ac
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x3356e
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x33599
cmp rbx, 0x6400000
ja 0x33599
mov rdx, rbx
mov ecx, edi
call fcn.0003548c
mov rdi, rax
test rax, rax
je 0x33569
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x3355a
mov rcx, rdi
call fcn.00035504
mov ebx, esi
jmp 0x3356e
cmp qword [rsp + 0x58], rbx
je 0x33580
mov rcx, rdi
call fcn.00035504
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x335ac
mov rcx, qword [rsp + 0xe0]
mov qword [0x0004f778], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x335ac
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x335c8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x335ec
xor al, al
jmp 0x33613
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x33624
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x33648
lea rax, [0x0003a4b0]
jmp 0x336b8
mov rcx, qword [rsp + 0x38]
call fcn.00039bee
mov r11, rax
test rax, rax
jne 0x33667
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x3363f
lea rdi, [0x0004f670]
mov byte [0x0004f773], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x3369f
mov al, byte [r11 + rcx]
test al, al
je 0x3369f
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x33680
test rdx, rdx
jne 0x336a7
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x339dc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x0004f790]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x33abd
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x33a23
xor eax, eax
jmp 0x33abd
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.0003548c
mov rbx, rax
test rax, rax
je 0x33a1c
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x33a5c
mov rcx, rbx
call fcn.00035504
jmp 0x33a1c
xor edi, edi
cmp dword [rbx], edi
jbe 0x33aae
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0003d710]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x33a99
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x33a66
jmp 0x33aae
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x0004f790], rax
mov rcx, rbx
call fcn.00035504
mov rax, qword [0x0004f790]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x340c8
Capabilities:
Attach user process memory
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov byte [rax + 8], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor ebx, ebx
and dword [rsp + 0x88], ebx
mov esi, 0x4000
mov rbp, rax
mov edi, esi
xor r12b, r12b
test rbx, rbx
je 0x34102
mov rcx, rbx
call fcn.00035504
mov edx, edi
mov ecx, 1
call fcn.0003548c
mov rbx, rax
test rax, rax
je 0x341e0
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rax
mov ecx, 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
add edi, esi
cmp eax, 0xc0000004
je 0x340f5
test eax, eax
js 0x341d8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbp, rax
je 0x34191
and qword [rsp + 0x90], 0
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x341d8
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r12b, 1
xor esi, esi
cmp dword [rbx], esi
jbe 0x341c8
lea rdi, [rbx + 0xe]
cmp ebp, dword [rdi - 6]
jne 0x341be
movzx edx, word [rdi]
lea r9, [rsp + 0x80]
lea r8, [fcn.00034064]
mov rcx, rbp
call fcn.0003603c
test al, al
je 0x341c8
inc esi
add rdi, 0x18
cmp esi, dword [rbx]
jb 0x3419b
test r12b, r12b
je 0x341d8
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call fcn.00035504
mov al, byte [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x3499c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x34ad7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x34acc
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00034874
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x34abe
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x34abe
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00034af8
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x3507c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x350b8
cmp dword [rsp + 0x48], 2
jne 0x3523c
lea eax, [r11 - 2]
jmp 0x3523e
mov eax, 6
cmp r11d, eax
jne 0x35155
mov ecx, dword [rsp + 0x48]
xor edx, edx
cmp ecx, edx
je 0x3523e
cmp ecx, 1
jne 0x350ff
cmp dword [rsp + 0x40], 0x1b58
jne 0x350eb
lea eax, [rcx + 7]
jmp 0x3523e
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x3523e
cmp ecx, 2
jne 0x3513c
mov eax, dword [rsp + 0x40]
cmp eax, 0x203a
jne 0x35117
lea eax, [rcx + 0xc]
jmp 0x3523e
cmp eax, 0x20d0
jne 0x35128
mov eax, 0xf
jmp 0x3523e
mov ecx, 0x11
cmp eax, 0x23f0
cmove edx, ecx
mov eax, edx
jmp 0x3523e
cmp ecx, 3
jne 0x3523c
cmp dword [rsp + 0x40], 0x2580
lea eax, [rcx + 0x11]
cmove edx, eax
jmp 0x35135
cmp r11d, 0xa
jne 0x3523c
xor edx, edx
cmp dword [rsp + 0x48], edx
jne 0x3523c
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x37c7
jne 0x3517f
lea eax, [rdx + 0x2d]
jmp 0x3523e
cmp ecx, 0x37bf
jne 0x35191
mov eax, 0x2b
jmp 0x3523e
cmp ecx, 0x37bb
jne 0x351a3
mov eax, 0x29
jmp 0x3523e
cmp ecx, 0x37b1
jne 0x351b5
mov eax, 0x27
jmp 0x3523e
lea eax, [rcx - 0x2b5e]
cmp eax, 0xc4d
ja 0x351c9
mov eax, 0x25
jmp 0x3523e
cmp ecx, 0x2b5b
jne 0x351d8
mov eax, 0x23
jmp 0x3523e
cmp ecx, 0x2b4a
jne 0x351e7
mov eax, 0x21
jmp 0x3523e
cmp ecx, 0x295a
jne 0x351f6
mov eax, 0x1f
jmp 0x3523e
cmp ecx, 0x2945
jne 0x35205
mov eax, 0x1d
jmp 0x3523e
cmp ecx, 0x2933
jne 0x35214
mov eax, 0x1b
jmp 0x3523e
cmp ecx, 0x2924
jne 0x35223
mov eax, 0x19
jmp 0x3523e
add ecx, 0xffffd800
mov eax, 0x17
cmp ecx, 0x124
cmovbe edx, eax
jmp 0x35135
xor eax, eax
add rsp, 0x38
ret
Function at 0x3524c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x3532b
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.0003548c
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x3530e
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.00039c50
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x35315
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x35348
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x3546a
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x3544a
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.0003548c
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x3543f
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.00039c50
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x35451
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x35920
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x35961
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x35955
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x35964
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x35940
xor r8d, r8d
test r8, r8
je 0x3597c
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x3597e
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x3598c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x359cb
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x359bf
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x359ce
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x359aa
xor r8d, r8d
test r8, r8
je 0x359e6
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x359e8
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x359f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x35b6c
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x35b6c
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x35b6c
test r8b, r8b
jne 0x35a48
mov rcx, rsi
call fcn.0003598c
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x35b6c
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x35b6c
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x35b6c
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x35a91
mov rcx, rsi
call fcn.0003598c
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x35aad
mov rcx, rsi
call fcn.0003598c
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x35ac5
mov rcx, rsi
call fcn.0003598c
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x35b6c
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x35b6c
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x35b6c
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x35b6c
cmp ebp, edx
jge 0x35b6c
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x35b24
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x35b64
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x35b3b
mov rcx, rsi
call fcn.0003598c
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x35b5c
inc rdx
test ecx, ecx
jne 0x35b49
test eax, eax
je 0x35b86
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x35af5
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x35b99
mov rcx, rsi
call fcn.0003598c
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x35b6e

Function at 0x35ba8
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x35bee
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x35bee
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x35bee
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x35be2
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x35bf1
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x35bd2
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x36158
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x3624f
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x3624f
mov rax, rdx
add rax, rcx
je 0x3624f
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x3624d
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x36249
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x36205
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x3623d
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x36228
inc rax
test r11d, r11d
jne 0x36212
cmp r10d, r8d
jne 0x36238
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x3624d
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x361e1
xor eax, eax
jmp 0x3625e
jmp 0x3625b
xor eax, eax
jmp 0x3625e
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x37934
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r12d, r8d
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp r8d, 0x40
jbe 0x379a3
lea ebx, [r8 - 0x41]
shr ebx, 6
inc ebx
mov rdx, rbp
mov rcx, rsi
call fcn.000370e4
add r12d, 0xffffffc0
add rbp, 0x40
sub rbx, 1
jne 0x3798a
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
call fcn.0003a1a0
lea rcx, [rsp + 0x20]
mov r8d, r12d
mov rdx, rbp
mov ebx, r12d
call fcn.00039c50
lea eax, [r12 + 1]
mov byte [rsp + rbx + 0x20], 0x80
cmp eax, 0x38
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov eax, edi
ja 0x37a1f
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x58], al
shr eax, 8
mov byte [rsp + 0x5c], dil
shr edi, 8
mov byte [rsp + 0x59], al
shr eax, 8
mov byte [rsp + 0x5d], dil
shr edi, 8
mov byte [rsp + 0x5a], al
shr eax, 8
mov byte [rsp + 0x5e], dil
shr edi, 8
mov byte [rsp + 0x5f], dil
mov byte [rsp + 0x5b], al
jmp 0x37a80
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x98], al
mov byte [rsp + 0x9c], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x99], al
shr eax, 8
mov byte [rsp + 0x9d], dil
shr edi, 8
mov byte [rsp + 0x9a], al
mov byte [rsp + 0x9e], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9f], dil
call fcn.000370e4
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.000370e4
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.00039b80
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x380c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx]
mov eax, dword [rdx]
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + rax + 1]
xor r8d, r8d
mov rcx, rbp
call fcn.00037b5c
mov r11, qword [rdi + 0x10]
movsxd rsi, dword [rdi]
add rsi, r11
xor r13d, r13d
cmp r11, rsi
jae 0x381ce
lea r15d, [r13 + 1]
mov r9, qword [rbx + 0x10]
movsxd r10, dword [rbx]
add r10, r9
cmp r9, r10
jae 0x381bf
mov r14, r13
mov rax, qword [rbp + 0x10]
movzx r8d, byte [r9]
xor edx, edx
lea r12, [r14 + rax]
movzx eax, byte [r11]
imul r8w, ax
mov eax, 0xff
movzx ecx, r8w
and cx, ax
movzx eax, byte [r12]
add cx, ax
mov eax, 0x100
cmp cx, ax
mov byte [r12], cl
mov ecx, 0x100
cmovae edx, r15d
add r12, r15
shr r8w, 8
movzx eax, byte [r12]
add r8w, ax
xor eax, eax
add r8w, dx
cmp r8w, cx
mov byte [r12], r8b
setae al
add r12, r15
test eax, eax
je 0x381b0
movzx eax, byte [r12]
add ax, r15w
mov byte [r12], al
add r12, r15
cmp ax, cx
jae 0x3819b
add r9, r15
add r14, r15
cmp r9, r10
jb 0x38132
add r11, r15
add r13, r15
cmp r11, rsi
jb 0x3811c
mov eax, dword [rdi + 8]
mov rcx, rbp
xor eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.00037c58
Function at 0x38de0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x740
xor r14d, r14d
mov rbp, r8
mov r10, rdx
lea r12d, [r14 + 1]
lea r13d, [r14 + 4]
mov r11, rcx
movzx r9d, r14w
movsx rax, r9w
add r9w, r12w
mov dword [r8 + rax*4], r14d
cmp r9w, r13w
jb 0x38e18
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r10 + rcx*4]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, r13w
jb 0x38e2e
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r11 + rcx*4]
mov dword [rsp + rcx*4 + 0x30], eax
cmp dx, r13w
jb 0x38e48
mov edi, 0x70
mov r11, r13
lea rbx, [rsp + 0x40]
mov rsi, rdi
movzx r8d, r14w
movsx rax, r8w
add r8w, r12w
lea rdx, [r11 + rax]
lea rcx, [r11 + rax - 4]
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rdx*4 + 0x30], eax
cmp r8w, r13w
jb 0x38e72
mov rcx, rbx
call fcn.00038d9c
add r11, r13
add rbx, 0x10
sub rsi, r12
jne 0x38e6e
movsx r9, word [0x0004e880]
movzx r8d, r14w
movsx rdx, r8w
add r8w, r12w
lea rax, [rdx + r9*4]
mov ecx, dword [rsp + rax*4 + 0x30]
and ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rbp + rdx*4], ecx
cmp r8w, r13w
jb 0x38eb1
lea r11, [0x0004ea48]
lea rcx, [rsp + 0x20]
call fcn.00038d9c
movsx r10, word [r11]
movsx rbx, word [r11 - 0x1c6]
movzx r9d, r14w
movsx r8, r9w
add r9w, r12w
lea rcx, [r8 + r10*4]
lea rax, [r8 + rbx*4]
mov edx, dword [rsp + rcx*4 + 0x30]
xor edx, dword [rsp + rax*4 + 0x30]
and edx, dword [rsp + r8*4 + 0x20]
xor dword [rbp + r8*4], edx
cmp r9w, r13w
jb 0x38ef0
add r11, 2
sub rdi, r12
jne 0x38ed6
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret