joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140595d40
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14058abec
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14058abec
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140595e90
cmp rax, 0xffffffffffffffff
je 0x140595e90
xor edi, edi
test rbp, rbp
jle 0x140595e3b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140585508
mov rbx, rax
test rax, rax
jne 0x140595dc8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140595e31
mov edx, 0x8000
mov ecx, r14d
call fcn.140582e20
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1405881b0
cmp eax, 0xffffffff
je 0x140595e11
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140595dd8
mov edx, r15d
mov ecx, r14d
call fcn.140582e20
jmp 0x140595e31
cmp byte [rsi + 0x38], dil
je 0x140595e28
cmp dword [rsi + 0x34], 5
jne 0x140595e28
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140595e31
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1405851e8
jmp 0x140595ea4
jns 0x140595ea4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14058abec
cmp rax, 0xffffffffffffffff
jne 0x140595e5c
cmp byte [rsi + 0x30], dil
je 0x140595ea4
mov edi, dword [rsi + 0x2c]
jmp 0x140595ea4
mov ecx, r14d
call fcn.140572da8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140595ea4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140595ea4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140595e9d
mov eax, dword [rsi + 0x2c]
jmp 0x140595ea2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14058abec
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400030ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
cmp word [0x14000cd18], di
jne 0x140003141
cmp dword [0x14000cd04], edi
jne 0x140003134
call fcn.1400060a4
test eax, eax
je 0x140003236
cmp word [0x14000cd18], di
jne 0x140003141
call fcn.140003f74
test eax, eax
je 0x140003236
call fcn.140005fe4
test eax, eax
je 0x140003236
call fcn.1400066c4
test eax, eax
je 0x140003236
mov ebx, 0x105
lea rcx, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
lea r8, [0x140009708]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140007ba8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400031c9
lea rdx, str.DecryptFileA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x1400031c9
xor edx, edx
lea rcx, [0x14000d610]
call qword [vtable.H_MA8HI.0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
cmp dword [0x14000cd04], edi
jne 0x140003273
cmp dword [0x14000de60], edi
jne 0x140003273
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x14000325a
mov edx, 0x4f0
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], FDIDestroy
xor ecx, ecx
call fcn.140004dcc
call fcn.140007700
mov dword [0x14000d544], eax
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140008470
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov edx, 2
lea rcx, [rsp + 0x140]
mov r8d, edx
call fcn.140006ca4
test eax, eax
je 0x140003236
lea rcx, [0x14000d610]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x140003291
mov edx, 0x4bc
jmp 0x140003212
cmp dword [0x14000cd0c], edi
jne 0x14000332d
lea rax, [0x14000d040]
mov ecx, 0x28
mov dword [rax], 1
lea rax, [rax + 0x20]
sub rcx, 1
jne 0x1400032a9
test byte [0x14000cd18], 1
jne 0x1400032fb
test byte [0x14000de64], 1
jne 0x1400032fb
mov eax, dword [0x14000c1ac]
lea r9, [0x140003910]
neg eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
sbb rdx, rdx
xor r8d, r8d
add rdx, 0x7d5
call fcn.140007ac8
test rax, rax
jmp 0x140003302
call fcn.140005d90
test eax, eax
jne 0x140003313
mov dword [0x14000d544], 0x8007042b
jmp 0x140003236
lea rcx, [0x1400078b0]
call fcn.14000772c
test eax, eax
je 0x140003236
mov dword [0x14000d544], edi
mov eax, dword [0x14000d028]
test al, 0x40
jne 0x140003349
test al, al
js 0x140003349
movzx ecx, word [0x14000de78]
call fcn.140002318
jmp 0x14000334b
mov eax, edi
mov dword [0x14000de7c], eax
mov eax, dword [0x14000cd04]
test eax, eax
jne 0x140003376
cmp dword [0x14000de60], edi
jne 0x140003376
call fcn.1400040c4
test eax, eax
je 0x140003236
mov eax, dword [0x14000cd04]
cmp word [0x14000cd18], di
jne 0x140003388
test eax, eax
jne 0x140003388
call fcn.14000494c
mov eax, 1
jmp 0x140003238
Function at 0x140005c30
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x30
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov esi, ecx
mov qword [rsp + 0x20], rdx
call fcn.140006540
test rax, rax
je 0x140005ccb
test rbx, rbx
jne 0x140005c7a
mov ecx, esi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140005ccb
and rdi, 0xfffffffffffff000
mov rsi, qword [rsp + 0x68]
mov qword [rsi], rdi
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov qword [rdi], rax
mov dword [r14], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, r14
mov rcx, qword [rsi]
call fcn.1400054c0
sub rax, qword [rsi]
mov qword [rdi], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
test rbx, rbx
jne 0x140005cc9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140005ccb
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140006060
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x30
mov r15d, r9d
mov rbx, r8
mov rsi, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov r12d, 0xc0000001
mov edi, r12d
test rdx, rdx
jne 0x1400060bc
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400060b7
xor al, al
jmp 0x140006190
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, rbx
call fcn.140005cf0
test al, al
je 0x140006169
lea rcx, [rbx - 1]
add rcx, r15
call fcn.140005cf0
test al, al
je 0x140006169
cmp dword [0x140018f9c], 0
je 0x140006103
call fcn.1400017d0
call fcn.14000a410
cmp dword [0x140018f9c], 0
jne 0x14000612d
movabs rax, 0x8000000000000000
cmp rbx, rax
jb 0x14000612d
mov r8d, r15d
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.140006930
xor edi, edi
cmp eax, r15d
cmovne edi, r12d
jmp 0x14000613f
mov r8, r15
mov rdx, rbx
mov rcx, qword [rsp + 0x70]
call fcn.14000c580
xor edi, edi
mov dword [rsp + 0x20], edi
cmp dword [0x140018f9c], 0
je 0x140006169
call fcn.14000a4b0
mov rbx, rax
call fcn.14000a460
call fcn.1400017e0
test rbx, rbx
cmovne edi, r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000617b
test rsi, rsi
jne 0x14000618b
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
setns al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140006230
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, r9d
mov r14, r8
mov r15, rdx
mov eax, ecx
mov rcx, rdx
mov qword [rsp + 0x28], rdx
mov ebx, 0xc0000001
test rdx, rdx
jne 0x140006286
mov ecx, eax
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140006281
xor al, al
jmp 0x1400063c6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, r14
call fcn.140005cf0
test al, al
je 0x14000639f
lea rcx, [r14 - 1]
add rcx, r13
call fcn.140005cf0
test al, al
je 0x14000639f
xor esi, esi
mov edi, esi
mov dword [rsp + 0x24], esi
cmp dword [0x140018f9c], esi
jne 0x1400062c9
cmp dword [0x140018f5c], esi
je 0x1400062fe
call fcn.1400017d0
cmp dword [0x140018f9c], esi
je 0x1400062db
call fcn.14000a410
cmp dword [0x140018f5c], esi
je 0x1400062fe
call fcn.140001b70
btr rax, 0x10
mov rcx, rax
call fcn.140001c20
mov edi, 1
mov dword [rsp + 0x24], edi
cmp dword [0x140018f9c], esi
jne 0x140006339
movabs rax, 0x8000000000000000
cmp r14, rax
jb 0x140006339
mov r8d, r13d
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.140006930
mov ebx, esi
cmp eax, r13d
mov r14d, 0xc0000001
cmovne ebx, r14d
jmp 0x140006354
mov r8, r13
mov rdx, qword [rsp + 0x80]
mov rcx, r14
call fcn.14000c580
mov ebx, esi
mov r14d, 0xc0000001
mov dword [rsp + 0x20], ebx
cmp dword [0x140018f9c], esi
jne 0x140006364
test edi, edi
je 0x14000639f
test edi, edi
je 0x14000637a
call fcn.140001b70
bts rax, 0x10
mov rcx, rax
call fcn.140001c20
cmp dword [0x140018f9c], esi
je 0x14000638f
call fcn.14000a4b0
mov rsi, rax
call fcn.14000a460
call fcn.1400017e0
test rsi, rsi
cmovne ebx, r14d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x1400063b1
test r15, r15
jne 0x1400063c1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebx, ebx
setns al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140006540
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14000f050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rcx, qword [0x14000f0d8]
test rcx, rcx
jne 0x14000660a
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x14000659a
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000c410
add rsp, 0x158
ret
cmp dword [rsp + 0x24], 0xa
jb 0x1400065f9
cmp dword [rsp + 0x2c], 0x3839
jb 0x1400065f9
call fcn.140001b90
and rax, 0xfffffffffffff000
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, rax
movabs rax, 0xffffff8000000000
and rcx, rax
movabs rax, 0x7ffffffff8
add rax, rcx
mov qword [0x140018f80], rax
movabs rax, 0x7b7ffffff8
add rax, rcx
mov qword [0x140018f88], rax
jmp 0x140006603
movabs rcx, 0xfffff68000000000
mov qword [0x14000f0d8], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000c410
add rsp, 0x158
ret
Function at 0x1400073d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
xor dil, dil
mov r15d, r12d
call fcn.140001790
movsxd rcx, eax
lea r13, [0x140017d20]
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
cdqe
mov r14d, r12d
mov rax, qword [r13 + rax*8]
mov rcx, qword [rax + 8]
cmp rcx, qword [rbx + 0x18]
setae r14b
jb 0x14000742b
call fcn.14000a240
call fcn.140001790
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
mov rsi, qword [rbx + 8]
cdqe
mov rax, qword [r13 + rax*8]
sub rsi, qword [rax]
mov rax, cr8
cmp al, 2
jae 0x140007466
mov r15d, 1
mov rdi, cr8
mov eax, 2
mov cr8, rax
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
je 0x1400075ea
call fcn.140001790
movsxd rcx, eax
mov r8, rsi
mov rdx, qword [r13 + rcx*8]
mov rcx, rbp
mov rdx, qword [rdx]
call fcn.14000c580
call fcn.140001790
movsxd rcx, eax
mov rbx, qword [r13 + rcx*8]
call fcn.140001790
movsxd rcx, eax
mov rax, qword [rbx]
mov rdx, qword [r13 + rcx*8]
mov qword [rdx + 8], rax
test r15d, r15d
je 0x1400074c6
movzx eax, dil
mov cr8, rax
cmp dword [0x140012388], r12d
je 0x140007506
mov rcx, qword [0x140012380]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], esi
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
jmp 0x1400075f2
cmp qword [0x140012308], r12
je 0x1400075f2
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, [0x140012360]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x1400075f2
lea rcx, [0x140012320]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rax, qword [0x140012308]
test rax, rax
je 0x1400075db
mov edx, dword [0x14000f008]
mov ecx, r12d
test edx, edx
jle 0x1400075db
nop
cmp dword [rax], r12d
jne 0x14000757e
inc ecx
add rax, 0x30
cmp ecx, edx
jl 0x140007560
lea rcx, [0x140012320]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x1400075f2
movsxd rax, ecx
lea rbx, [rax + rax*2]
mov rax, qword [0x140012308]
shl rbx, 4
mov dword [rbx + rax], r12d
test ecx, ecx
js 0x1400075db
mov rax, qword [0x140012308]
mov qword [rbx + rax + 8], rbp
mov rax, qword [0x140012308]
mov dword [rbx + rax + 0x10], esi
call fcn.140001790
mov r8, qword [0x140012308]
mov dword [rbx + r8 + 0x14], eax
xor r8d, r8d
mov rcx, qword [0x140012308]
add rcx, 0x18
add rcx, rbx
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
lea rcx, [0x140012320]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x1400075f2
movzx eax, dil
mov cr8, rax
call fcn.1400017d0
lea r11, [rsp + 0x60]
mov eax, r14d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009280
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14000f050]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [0x14000f4a0]
lea r9, [0x14000f4c0]
movsxd rdx, ecx
lea r8, str._sCPU_d.trace
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xb0]
mov rbx, qword [rax + rdx*8]
mov edx, 0xc8
call sub.ntoskrnl.exe_swprintf_s
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor edi, edi
mov dword [rsp + 0x78], 0x240
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x60]
mov qword [rbx + 0x110], rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x50], edi
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x48], rdi
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], 0x24
lea rcx, [rbx + 0x110]
mov dword [rsp + 0x38], edi
mov edx, 0x10100005
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c410
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x4318e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rbp, rcx
mov rbx, rdx
mov ecx, 4
cqo
idiv rcx
mov rcx, qword [0x0049f450]
lea rdi, [rax*4]
call fcn.0043dcb0
xor ecx, ecx
xor r10d, r10d
mov r9b, byte [rax]
cmp rdi, rcx
jg 0x431932
mov rax, rbx
mov r8d, 4
add rbp, rcx
cqo
idiv r8
xor r8d, r8d
jmp 0x43196f
mov edx, dword [rbp + rcx]
add rcx, 4
imul edx, edx, 0xcc9e2d51
rol edx, 0xf
test r9b, r9b
jne 0x4319bd
imul edx, edx, 0x1b873593
xor edx, r10d
rol edx, 0xd
lea edx, [rdx + rdx*4]
lea r10d, [rdx - 0x19ab949c]
jmp 0x431917
dec rdx
shl r8d, 8
movzx eax, byte [rbp + rdx]
or r8d, eax
test rdx, rdx
jg 0x431960
imul r8d, r8d, 0xcc9e2d51
rol r8d, 0xf
test r9b, r9b
jne 0x4319bd
imul r8d, r8d, 0x1b873593
mov edx, r10d
xor edx, ebx
xor r8d, edx
mov esi, r8d
shr esi, 0x10
xor r8d, esi
imul esi, r8d, 0x85ebca6b
mov r8d, esi
shr r8d, 0xd
xor r8d, esi
imul r8d, r8d, 0xc2b2ae35
mov esi, r8d
shr esi, 0x10
xor esi, r8d
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4319c9
Capabilities:
Hash data with crc32

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, 1
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
cpuid
mov r12d, ecx
mov rcx, qword [0x0049f450]
call fcn.0043dcb0
cmp byte [rax], 0
mov rbp, rax
je 0x431a00
xor eax, eax
jmp 0x431b15
bt r12d, 0x13
jae 0x431a2f
and r12b, 2
je 0x431a2f
cmp rdi, 0x3f
jle 0x431a2f
mov rbx, rdi
mov rcx, rsi
and rbx, 0xfffffffffffffff0
mov rdx, rbx
call fcn.0043b9a7
cmp byte [rbp], 0
not eax
je 0x431a33
jmp 0x4319f9
xor ebx, ebx
xor eax, eax
cmp rbx, rdi
jge 0x431b15
lea rcx, [rsi + rbx]
mov rdx, rdi
not eax
lea r10, [0x0049c420]
sub rdx, rbx
mov bl, byte [rbp]
xor esi, esi
mov r11, rdx
mov r12, rdx
and r11, 0xfffffffffffffff8
cmp r11, rsi
jne 0x431a6f
lea r9, [0x0049c420]
jmp 0x431b0a
test bl, bl
mov r8d, dword [rcx + rsi]
jne 0x431b15
xor eax, r8d
mov r8d, dword [rcx + rsi + 4]
add rsi, 8
mov edi, r8d
movzx r9d, r8b
mov edx, r8d
shr edi, 0x18
mov r9d, dword [r10 + r9*4 + 0xc00]
shr r8d, 0x10
xor r9d, dword [r10 + rdi*4]
movzx edi, al
movzx r8d, r8b
xor r9d, dword [r10 + rdi*4 + 0x1c00]
mov edi, eax
shr edi, 0x18
xor r9d, dword [r10 + rdi*4 + 0x1000]
movzx edi, dh
xor r9d, dword [r10 + rdi*4 + 0x800]
movzx edi, ah
shr eax, 0x10
xor r9d, dword [r10 + r8*4 + 0x400]
movzx r8d, al
xor r9d, dword [r10 + rdi*4 + 0x1800]
mov eax, dword [r10 + r8*4 + 0x1400]
xor eax, r9d
jmp 0x431a5e
mov r8b, byte [rcx + r11]
inc r11
xor r8d, eax
shr eax, 8
movzx r8d, r8b
xor eax, dword [r9 + r8*4]
cmp r12, r11
jg 0x431af5
test bl, bl
jne 0x431b15
not eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x43210b
Capabilities:
Write file on windows

Disassembly:
push rdi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rbx, rcx
mov r10, rdx
je 0x432134
mov rdi, rdx
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
mov rdx, rcx
not rdx
lea r8, [rdx - 1]
mov rcx, r10
mov r9, rbx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rdi
jmp 0x43da30
jmp qword [sym.imp.msvcrt.dll_fflush]
Function at 0x43ca40
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004a49c4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x43cbc8
mov rax, qword [0x004a49c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x43ca8c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x43cb15
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x43ca70
mov rcx, rbx
call fcn.0043d6e0
test rax, rax
mov r12, rax
je 0x43cbfd
mov rax, qword [0x004a49c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0043d810
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004a49c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x43cbe0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x43cb0e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x43cb70
add dword [0x004a49c4], 1
cmp edi, 8
jae 0x43cb43
test dil, 4
jne 0x43cbb4
test edi, edi
je 0x43cb38
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x43cbcf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x43cb38
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x43cb5c
jmp 0x43cb38
add rsi, qword [0x004a49c8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x43cb0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00442a80
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x43cb38
xor esi, esi
jmp 0x43ca97
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x43cb38
mov rax, qword [0x004a49c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00442a80
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00442a80
nop
nop dword [rax]

Function at 0x43d350
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004a4ca0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004a4c80]
test rbx, rbx
je 0x43d3a4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x43d39b
test rsi, rsi
je 0x43d39b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x43d380
lea rcx, [0x004a4ca0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x43d6e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0049f460]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x43d74d
mov rcx, r8
call fcn.0043d5c0
test eax, eax
je 0x43d74d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x43d74d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x43d744
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x43d74f
add rax, 0x28
cmp rax, r9
jne 0x43d730
xor eax, eax
add rsp, 0x28
ret

Function at 0x43e5c0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00443478], eax
je 0x43e5da
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x43eae0
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x43eb03
call fcn.00441820
cmp eax, 1
je 0x43eb0e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x43eb85
mov eax, 0x28
jmp 0x43eb6a
add rax, 1
cmp rax, 0x6b
je 0x43eb77
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x43eb60
cmp eax, 0x6a
jne 0x43eb8a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x43eb77