joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400106f0
Capabilities:
Query environment variable

Disassembly:
push r12
sub rsp, 0x20
call fcn.140010060
mov r12, rcx
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rcx, rax
call fcn.140010149
mov r8d, eax
mov al, 1
test r8b, r8b
je 0x140010727
mov rcx, r12
call fcn.14001065d
not rax
shr rax, 0x3f
add rsp, 0x20
pop r12
ret

Function at 0x1400108a9
Capabilities:
Query environment variable

Disassembly:
push r13
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov r13, rdx
call fcn.14001065d
test rax, rax
jns 0x1400108ec
mov rcx, qword [rsp + 0x28]
call fcn.140010060
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rcx, rax
call fcn.140010149
test al, al
jne 0x140010926
add rsp, 0x38
pop rbx
pop r13
jmp fcn.14000574d
lea rbx, [rax + 2]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3d
mov rax, qword [0x140138890]
mov rcx, qword [rax + rbx*8]
call fcn.14000c137
lea rdx, [rax + 1]
mov rax, qword [0x140138890]
mov rcx, qword [rax + rbx*8]
add rsp, 0x38
pop rbx
pop r13
jmp fcn.140006a45
mov rcx, r13
add rsp, 0x38
pop rbx
pop r13
jmp fcn.140006aae

Function at 0x140010cd6
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
call fcn.140010060
mov rcx, rax
call sub.msvcrt.dll_system
cdqe
add rsp, 0x28
ret

Function at 0x1400117d0
Capabilities:
Hash data using murmur3

Disassembly:
xor r10d, r10d
mov rax, rdx
mov r9, rcx
mov r8, rdx
mov ecx, 4
cqo
idiv rcx
xor ecx, ecx
shl rax, 2
cmp rax, rcx
jg 0x140011812
xor edx, edx
cmp rax, 0xfffffffffffffffd
mov ecx, 4
cmovge rdx, rax
mov rax, r8
mov r11, rdx
cqo
idiv rcx
add r9, r11
xor ecx, ecx
jmp 0x14001183b
mov edx, dword [r9 + rcx]
add rcx, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x1400117ec
test rdx, rdx
jle 0x14001184f
dec rdx
shl ecx, 8
movzx eax, byte [r9 + rdx]
or ecx, eax
jmp 0x14001183b
imul eax, ecx, 0xcc9e2d51
xor r10d, r8d
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r10d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor edx, edx
test rcx, rcx
je 0x140011890
mov rdx, qword [rcx]
add rcx, 0x10
jmp 0x1400117d0
Function at 0x140011886
Capabilities:
Hash data using murmur3

Disassembly:
xor r10d, r10d
mov rax, rdx
mov r9, rcx
mov r8, rdx
mov ecx, 4
cqo
idiv rcx
xor ecx, ecx
shl rax, 2
cmp rax, rcx
jg 0x140011812
xor edx, edx
cmp rax, 0xfffffffffffffffd
mov ecx, 4
cmovge rdx, rax
mov rax, r8
mov r11, rdx
cqo
idiv rcx
add r9, r11
xor ecx, ecx
jmp 0x14001183b
mov edx, dword [r9 + rcx]
add rcx, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x1400117ec
test rdx, rdx
jle 0x14001184f
dec rdx
shl ecx, 8
movzx eax, byte [r9 + rdx]
or ecx, eax
jmp 0x14001183b
imul eax, ecx, 0xcc9e2d51
xor r10d, r8d
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r10d
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor edx, edx
test rcx, rcx
je 0x140011890
mov rdx, qword [rcx]
add rcx, 0x10
jmp 0x1400117d0

Function at 0x14001238f
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r13, rcx
mov r14, rdx
mov r12, r8
test rcx, rcx
jne 0x1400123bf
cmp qword [0x140139560], 0
jne 0x1400123e5
call fcn.14000d6a6
mov qword [0x140139560], rax
jmp 0x1400123e5
mov rcx, rdx
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x140012452
test r12, r12
je 0x1400123a7
cmp qword [r12], 0
jg 0x140012436
jmp 0x1400123a7
mov r13, qword [0x140139560]
test r13, r13
jne 0x1400123f5
xor eax, eax
jmp 0x140012452
mov rcx, r14
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x140012452
test r12, r12
je 0x1400123f1
cmp qword [r12], 0
jle 0x1400123f1
mov rcx, r12
call fcn.140012300
mov rcx, r13
mov rdx, rax
add rsp, 0x20
pop r12
pop r13
pop r14
jmp sub.KERNEL32.dll_GetProcAddress
mov rcx, r12
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400123a7
add rsp, 0x20
pop r12
pop r13
pop r14
ret
push r12
sub rsp, 0x30
cmp qword [0x140139558], 0
mov r12, rcx
mov r8, rdx
jne 0x140012492
mov qword [rsp + 0x28], rdx
lea rcx, [0x1400aee80]
xor edx, edx
call fcn.14000d82b
mov r8, qword [rsp + 0x28]
mov qword [0x140139558], rax
mov rcx, qword [0x140139558]
mov rdx, r12
add rsp, 0x30
pop r12
jmp 0x14001238f
Function at 0x14001245d
Capabilities:
Link many functions at runtime

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r13, rcx
mov r14, rdx
mov r12, r8
test rcx, rcx
jne 0x1400123bf
cmp qword [0x140139560], 0
jne 0x1400123e5
call fcn.14000d6a6
mov qword [0x140139560], rax
jmp 0x1400123e5
mov rcx, rdx
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x140012452
test r12, r12
je 0x1400123a7
cmp qword [r12], 0
jg 0x140012436
jmp 0x1400123a7
mov r13, qword [0x140139560]
test r13, r13
jne 0x1400123f5
xor eax, eax
jmp 0x140012452
mov rcx, r14
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
jne 0x140012452
test r12, r12
je 0x1400123f1
cmp qword [r12], 0
jle 0x1400123f1
mov rcx, r12
call fcn.140012300
mov rcx, r13
mov rdx, rax
add rsp, 0x20
pop r12
pop r13
pop r14
jmp sub.KERNEL32.dll_GetProcAddress
mov rcx, r12
call fcn.140012300
mov rcx, r13
mov rdx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400123a7
add rsp, 0x20
pop r12
pop r13
pop r14
ret
push r12
sub rsp, 0x30
cmp qword [0x140139558], 0
mov r12, rcx
mov r8, rdx
jne 0x140012492
mov qword [rsp + 0x28], rdx
lea rcx, [0x1400aee80]
xor edx, edx
call fcn.14000d82b
mov r8, qword [rsp + 0x28]
mov qword [0x140139558], rax
mov rcx, qword [0x140139558]
mov rdx, r12
add rsp, 0x30
pop r12
jmp 0x14001238f

Function at 0x14001266a
Capabilities:
Link many functions at runtime

Disassembly:
push r12
sub rsp, 0x30
cmp qword [0x140139520], 0
mov r12, rcx
mov r8, rdx
jne 0x14001269f
mov qword [rsp + 0x28], rdx
lea rcx, [0x1400aed20]
xor edx, edx
call fcn.14000d82b
mov r8, qword [rsp + 0x28]
mov qword [0x140139520], rax
mov rcx, qword [0x140139520]
mov rdx, r12
add rsp, 0x30
pop r12
jmp 0x14001238f
Function at 0x140016290
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rsi, [0x1400afac0]
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_scheme
test dl, dl
mov rbx, rcx
mov edx, 6
cmovne rsi, rax
test rcx, rcx
je 0x1400162cd
mov rax, qword [rcx]
mov ecx, 3
shl rax, 2
cqo
idiv rcx
lea rdx, [rax + 6]
xor ecx, ecx
call fcn.140005a75
mov rcx, rax
test rbx, rbx
je 0x1400162f1
mov r9, qword [rbx]
mov edi, 3
mov rax, r9
cqo
idiv rdi
mov r11, rdx
jmp 0x1400162f7
xor r9d, r9d
xor r11d, r11d
sub r9, r11
lea rax, [rcx + 0x10]
xor r10d, r10d
cmp r10, r9
jne 0x14001631b
movabs r8, 0xaaaaaaaaaaaaaaac
imul r8, r10
test rbx, rbx
jne 0x140016377
jmp 0x140016389
movzx edx, byte [rbx + r10 + 0x11]
movzx r8d, byte [rbx + r10 + 0x10]
add rax, 4
shl r8d, 0x10
shl edx, 8
or edx, r8d
movzx r8d, byte [rbx + r10 + 0x12]
add r10, 3
mov edi, edx
shr edi, 0x12
or r8d, edx
shr edx, 0xc
mov dil, byte [rsi + rdi]
and edx, 0x3f
mov byte [rax - 4], dil
mov dl, byte [rsi + rdx]
mov byte [rax - 3], dl
mov edx, r8d
and r8d, 0x3f
shr edx, 6
and edx, 0x3f
mov dl, byte [rsi + rdx]
mov byte [rax - 2], dl
mov dl, byte [rsi + r8]
mov byte [rax - 1], dl
jmp 0x140016301
mov rax, qword [rbx]
mov edi, 3
cqo
idiv rdi
dec rdx
je 0x1400163ce
cmp r11, 2
jne 0x1400163ff
movzx edx, byte [rbx + r9 + 0x10]
movzx eax, byte [rbx + r9 + 0x11]
shl edx, 0x10
shl eax, 8
or eax, edx
shr edx, 0x12
mov dl, byte [rsi + rdx]
mov byte [rcx + r8 + 0x10], dl
mov edx, eax
shr eax, 6
shr edx, 0xc
and eax, 0x3c
and edx, 0x3f
mov dl, byte [rsi + rdx]
mov byte [rcx + r8 + 0x11], dl
mov al, byte [rsi + rax]
mov byte [rcx + r8 + 0x12], al
jmp 0x1400163f5
movzx eax, byte [rbx + r10 + 0x10]
mov edx, eax
shl eax, 4
shr edx, 2
and eax, 0x30
mov dl, byte [rsi + rdx]
mov byte [rcx + r8 + 0x10], dl
mov al, byte [rsi + rax]
mov byte [rcx + r8 + 0x12], 0x3d
mov byte [rcx + r8 + 0x11], al
mov byte [rcx + r8 + 0x13], 0x3d
add r8, 4
mov rdx, r8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005a75
Function at 0x140017204
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
test rcx, rcx
je 0x1400118df
mov rax, qword [rcx]
xor r8d, r8d
lea r9, [rax - 1]
xor eax, eax
cmp r8, r9
jg 0x1400118df
mov dl, byte [rcx + r8 + 0x10]
lea r10d, [rdx - 0x41]
cmp r10b, 0x19
ja 0x1400118c3
add edx, 0x20
movzx edx, dl
inc r8
add rax, rdx
imul rdx, rax, 0x401
mov rax, rdx
shr rax, 6
xor rax, rdx
jmp 0x1400118ac
lea rax, [rax + rax*8]
mov rdx, rax
shr rdx, 0xb
xor rax, rdx
imul rax, rax, 0x8001
ret
xor eax, eax
test rcx, rcx
je 0x14001193a
mov r9, qword [rcx]
xor r8d, r8d
cmp r8, r9
jge 0x14001193a
mov dl, byte [rcx + r8 + 0x10]
inc r8
cmp dl, 0x5f
je 0x140011902
lea r10d, [rdx - 0x41]
cmp r10b, 0x19
ja 0x140011921
add edx, 0x20
movzx edx, dl
add rax, rdx
imul rdx, rax, 0x401
mov rax, rdx
shr rax, 6
xor rax, rdx
jmp 0x140011902
lea rax, [rax + rax*8]
mov rdx, rax
shr rdx, 0xb
xor rax, rdx
imul rax, rax, 0x8001
ret
mov r8, rcx
mov rcx, rdx
mov al, byte [r8 + 0x18]
cmp al, 1
je 0x14001721f
cmp al, 2
je 0x140017224
test al, al
jne 0x140017229
jmp fcn.140011886
jmp 0x140011899
jmp 0x1400118f5
xor eax, eax
ret
Function at 0x140037bd8
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor ebx, ebx
lea rdi, [0x1400dc290]
mov dword [rsp + 0x24], edx
mov r14, rcx
mov edx, 0x28
lea rcx, [0x140144340]
call fcn.140005775
xor ecx, ecx
mov r12, rax
call fcn.14002194d
lea rcx, [r12 + 0x10]
mov rdx, rax
call fcn.14003147e
mov rdx, qword [r14 + 0x70]
mov rcx, qword [r14]
mov r9d, 0xf4240
mov r8d, 2
call fcn.14001573f
mov r13, rax
test rax, rax
je 0x140037c5e
cmp qword [rax], 0
je 0x140037c5e
lea rdx, [0x1400dc640]
mov rcx, rax
call fcn.14003041d
test al, al
je 0x140037c77
jmp 0x140037e55
mov rcx, r14
call fcn.14003755f
lea rcx, [0x1400dc160]
call fcn.1400345b5
jmp 0x140037e55
test bl, bl
lea r15, [rsp + 0x30]
je 0x140037cb6
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x48], 0
call fcn.140031444
mov rbx, rax
test rax, rax
jg 0x140037dd2
lea rcx, [0x1400dc220]
call fcn.1400345b5
jmp 0x140037dd2
xor r8d, r8d
lea rdx, [0x1400dc310]
mov rcx, r13
call fcn.14000b4a0
mov rsi, rax
test rax, rax
jg 0x140037d11
mov rax, qword [r13]
lea rcx, [rax + 0x18]
call fcn.14000587b
lea rdx, [0x1400dc2e0]
mov r9, rax
mov rcx, rax
call fcn.1400313cc
mov rdx, r13
mov rcx, r9
call fcn.1400313f2
mov rcx, r9
lea rdx, [0x1400dc2b0]
call fcn.1400313cc
mov rcx, r9
call fcn.1400345b5
mov r8, rsi
mov rdx, rdi
mov rcx, r13
call fcn.14000b4a0
mov rbx, rax
test rax, rax
jg 0x140037d52
lea rbp, [0x1400dc270]
mov r8, rsi
mov rcx, r13
mov rdx, rbp
call fcn.14000b4a0
mov rbx, rax
test rax, rax
jg 0x140037d6c
lea rcx, [0x1400dc240]
call fcn.1400345b5
jmp 0x140037d6c
mov rbp, qword [r12]
mov rcx, rdi
call fcn.1400057f5
mov qword [r12], rax
mov rcx, rbp
test rbp, rbp
jne 0x140037d8e
jmp 0x140037d93
mov r8, qword [r12]
mov rcx, rbp
mov qword [rsp + 0x28], r8
call fcn.1400057f5
mov r8, qword [rsp + 0x28]
mov qword [r12], rax
test r8, r8
je 0x140037d93
mov rcx, r8
call fcn.1400302d7
add rbx, rsi
mov rcx, r13
mov rdx, rbx
call fcn.1400302a2
mov r8d, 1
mov rcx, r15
lea rdx, [rbx + rax]
call fcn.14003030d
mov rdx, r15
mov rcx, r13
call fcn.140030465
lea rcx, [r12 + 8]
mov rdx, rax
call fcn.14003147e
mov bl, 1
jmp 0x140037c20
cmp byte [r13 + rbx + 0x10], 0x3a
je 0x140037de6
lea rcx, [0x1400dc220]
call fcn.1400345b5
mov r8d, 1
lea rdx, [rbx + 1]
mov rcx, r15
call fcn.14003030d
mov rdx, r15
mov rcx, r13
call fcn.140030465
mov r8d, 1
mov edx, 1
lea r9, [0x1400dc200]
mov rcx, rax
call fcn.14000ccf6
mov rcx, qword [r12 + 0x10]
mov rdx, qword [rsp + 0x48]
mov r8, rax
call fcn.140021af3
mov rax, qword [r12 + 0x10]
mov rcx, qword [rax]
call fcn.14001a420
cmp rax, 0x2710
jle 0x140037dcb
lea rcx, [0x1400dc1c0]
call fcn.1400345b5
jmp 0x140037dcb
cmp byte [rsp + 0x24], 0
je 0x140037ea4
mov rcx, r12
call fcn.140037584
cmp rax, 0xcc
je 0x140037ea4
xor ecx, ecx
call fcn.140017f3e
lea rcx, [r14 + 0xb8]
mov rdx, rax
call fcn.14003147e
mov rdx, qword [r14 + 0xb8]
lea rcx, [r12 + 0x20]
call fcn.14003147e
mov rdx, qword [r12 + 0x10]
mov r8, qword [r12]
mov rcx, r14
call fcn.140037884
mov rax, r12
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14009a9d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400a5a80
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400a5a80
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14009b602
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140172588]
test eax, eax
je 0x14009b69a
lea rax, [0x140172560]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140172590]
mov qword [rbp - 8], rax
jmp 0x14009b67e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14009b672
cmp qword [rbp - 0x10], 0
je 0x14009b672
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14009b638
lea rax, [0x140172560]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14009b69b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14009b7a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14009b7c8
mov eax, 0
jmp 0x14009b816
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14009b7f1
mov eax, 0
jmp 0x14009b816
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14009b811
mov eax, 0
jmp 0x14009b816
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14009b81c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14009b89a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14009b891
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14009b891
mov rax, qword [rbp - 8]
jmp 0x14009b8af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14009b864
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140015adc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140015b5a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015b51
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015b51
mov rax, qword [rbp - 8]
jmp 0x140015b6f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015b24
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140003384
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400033ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400033ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400033ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400033ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400033ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400033d0
xor al, al
add rsp, 0x28
ret
Function at 0x180038bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x18008f040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x180038be8
cmp al, 0x25
jne 0x180038bdd
cmp byte [rcx + 1], al
jne 0x180038be8
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x180038bd1
cmp byte [rcx], 0x25
jne 0x180038cb9
cmp byte [rcx + 1], 0x25
je 0x180038cb9
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.180006590
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x180038c2d
inc rcx
cmp byte [rcx], 0x20
je 0x180038c25
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180038ca7
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x180038c46
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x180038c96
movss xmm2, dword [0x1800837ac]
nop dword [rax]
cmp al, 0x39
ja 0x180038c96
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x180038c70
cmp dl, 0x2d
jne 0x180038cb4
xorps xmm1, xmmword [0x180083c40]
movaps xmm0, xmm1
jmp 0x180038cbc
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180038cbc
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180070d20
add rsp, 0x80
pop rbx
ret

Function at 0x180038ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x18008f040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x180038d18
cmp al, 0x25
jne 0x180038d0d
cmp byte [rcx + 1], al
jne 0x180038d18
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x180038d01
cmp byte [rcx], 0x25
jne 0x180038ddb
cmp byte [rcx + 1], 0x25
je 0x180038ddb
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.180006590
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x180038d59
inc rcx
cmp byte [rcx], 0x20
je 0x180038d51
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180038dcd
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x180038d72
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x180038dbc
movsd xmm2, qword [0x180083778]
cmp al, 0x39
ja 0x180038dbc
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x180038d98
cmp dl, 0x2d
jne 0x180038dd6
xorps xmm1, xmmword [0x180083c30]
movaps xmm0, xmm1
jmp 0x180038dde
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180038dde
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180070d20
add rsp, 0x80
pop rbx
ret
Function at 0x180039de0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x18008f040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x180039e2f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18016a2c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x180039e6d
cmp rsi, r14
jb 0x180039e65
cmp rsi, r15
jae 0x180039e65
cmp qword [rsi + 8], 0
jne 0x18003a037
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180039e50
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180039f02
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180039ef9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180039ef9
cmp dword [rsp + 0x40], 0x10000
je 0x180039f7b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x180039ef9
sub rbx, rbp
cmp rbx, r14
jae 0x180039ec0
test rsi, rsi
jne 0x180039fe0
cmp rdi, r15
ja 0x18003a01f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18003a01f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003a01f
cmp dword [rsp + 0x40], 0x10000
je 0x180039fb1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180039f32
jmp 0x18003a01f
test rbx, rbx
je 0x180039ef9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180039fe0
cmp rbx, r14
jae 0x180039ea0
jmp 0x180039f02
test rdi, rdi
je 0x18003a01f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180039fe0
cmp rdi, r15
jbe 0x180039f10
jmp 0x18003a01f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180039ff0
mov rax, qword [0x18016a2c0]
mov qword [rsi], rax
mov qword [0x18016a2c0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180070d20
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret