joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d6d90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1401d6dc8
mov rax, qword [r9 + 0x30]
and rax, rcx
mov rdi, qword [r9 + 8]
mov r8, rax
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x1401d6e57
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x1401d6e57
mov edx, dword [r10]
add rax, rax
mov rdi, qword [rdi + 8]
cmp edx, dword [rdi + 0x10]
je 0x1401d6e27
cmp rdi, qword [rcx + rax*8]
jne 0x1401d6e16
jmp 0x1401d6e57
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1401d6eeb
mov rax, qword [rbx]
cmp rdi, rax
je 0x1401d6e8c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1401d6ea9
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1401d6ed8
cmp rax, rdi
jne 0x1401d6eb4
mov qword [rdx + r8*8], rbx
jmp 0x1401d6ed8
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1401d6ed8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1401d7d68
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401d7e18
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x1401d7e35
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1401d7e8d
cmp qword [rcx + rdx*8], r8
jne 0x1401d7e82
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1401d7e86
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401d7e9a
cmp qword [rcx + rdx*8], r8
jne 0x1401d7e9a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140210c50
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401de448
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
mov r10, rcx
xor edx, edx
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r11]
xor r10, rax
imul r10, r8
inc rdx
cmp rdx, 4
jb 0x1401de487
xor edx, edx
movzx eax, byte [r11 + rdx + 4]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 2
jb 0x1401de49e
imul rdx, r10, 0x18d
xor rdx, rcx
and rdx, qword [r9 + 0x30]
mov rdi, qword [r9 + 8]
mov r8, rdx
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x1401de544
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x1401de544
mov r10d, dword [r11]
add rdx, rdx
mov rdi, qword [rdi + 8]
cmp r10d, dword [rdi + 0x10]
jne 0x1401de506
movzx eax, word [rdi + 0x14]
cmp word [r11 + 4], ax
jne 0x1401de506
mov eax, 1
jmp 0x1401de508
xor eax, eax
test al, al
jne 0x1401de514
cmp rdi, qword [rcx + rdx*8]
jne 0x1401de4ea
jmp 0x1401de544
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1401de5d8
mov rax, qword [rbx]
cmp rdi, rax
je 0x1401de579
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1401de596
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1401de5c5
cmp rax, rdi
jne 0x1401de5a1
mov qword [rdx + r8*8], rbx
jmp 0x1401de5c5
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1401de5c5
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1401de9cc
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dea7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
mov rbx, rcx
mov r11d, r10d
movabs rdx, 0x100000001b3
movzx eax, byte [r11 + r8 + 0x10]
inc r11
xor rbx, rax
imul rbx, rdx
cmp r11, 4
jb 0x1401deaa9
movzx eax, byte [r8 + r10 + 0x14]
inc r10
xor rcx, rax
imul rcx, rdx
cmp r10, 2
jb 0x1401deabf
imul rdx, rbx, 0x18d
xor rdx, rcx
mov rcx, qword [r9 + 0x18]
and rdx, qword [r9 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1401deb14
cmp qword [rcx + rdx*8], r8
jne 0x1401deb09
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1401deb0d
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401deb21
cmp qword [rcx + rdx*8], r8
jne 0x1401deb21
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140210c50
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401deb54
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
movabs r9, 0xcbf29ce484222325
mov rdi, rcx
mov rbx, r9
movabs rsi, 0x100000001b3
lea r10d, [r11 + 1]
movzx eax, byte [r8 + r11]
add r11, r10
xor rbx, rax
imul rbx, rsi
cmp r11, 4
jb 0x1401deb84
xor ecx, ecx
movzx eax, byte [r8 + rcx + 4]
add rcx, r10
xor r9, rax
imul r9, rsi
cmp rcx, 2
jb 0x1401deb9b
mov r11, qword [rdi + 0x18]
imul rcx, rbx, 0x18d
xor rcx, r9
mov r9, qword [rdi + 8]
and rcx, qword [rdi + 0x30]
mov rax, rcx
add rax, rax
lea rbx, [rcx + rcx]
mov rax, qword [r11 + rax*8]
cmp qword [r11 + rbx*8], r9
jne 0x1401debe0
mov rcx, r9
jmp 0x1401debe8
mov rcx, qword [r11 + rbx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401dec32
mov ecx, dword [r8]
cmp dword [rax + 0x10], ecx
jne 0x1401dec05
movzx ecx, word [r8 + 4]
cmp word [rax + 0x14], cx
jne 0x1401dec05
mov ecx, r10d
jmp 0x1401dec07
xor ecx, ecx
test cl, cl
jne 0x1401dec10
mov rax, qword [rax]
jmp 0x1401debd5
mov ecx, dword [rax + 0x10]
cmp dword [r8], ecx
jne 0x1401dec23
movzx ecx, word [rax + 0x14]
cmp word [r8 + 4], cx
je 0x1401dec26
xor r10d, r10d
test r10b, r10b
cmove rax, r9
mov qword [rdx], rax
jmp 0x1401dec35
mov qword [rdx], r9
mov rbx, qword [rsp + 8]
mov rax, rdx
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14020f130
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140211714
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x14030b180]
xor ecx, ecx
lea r8, [0x14030b178]
lea rdx, [0x140307ae8]
call fcn.14021153c
mov rbx, rax
test rax, rax
je 0x140211754
mov rcx, rax
call fcn.14020f628
mov rcx, rdi
call rbx
jmp 0x14021175a
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1402117bc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x14030b190]
mov ecx, 2
lea r8, [0x14030b188]
lea rdx, [0x140307b00]
call fcn.14021153c
mov rdi, rax
test rax, rax
je 0x1402117fd
mov rcx, rax
call fcn.14020f628
mov ecx, ebx
call rdi
jmp 0x140211805
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140211810
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14030b198]
mov edi, ecx
lea rdx, [0x140307b10]
mov ecx, 3
lea r8, [0x14030b190]
call fcn.14021153c
mov rsi, rax
test rax, rax
je 0x14021185c
mov rcx, rax
call fcn.14020f628
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140211867
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14021c32c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14021c33f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14021c964
lea rdx, [0x1403216c8]
lea rcx, [rsp + 0x20]
call fcn.14021017c
int3

Function at 0x14021c494
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
test rax, rax
je 0x14021c4d8
mov ecx, 1
lock xadd dword [0x1403fe220], ecx
inc ecx
cmp ecx, 1
jne 0x14021c4d8
call fcn.14021c4e4
lock inc dword [0x1403c9ce8]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140223040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x140223058
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x1402230a2
mov ecx, dword [r11]
cmp dword [rax + 8], ecx
je 0x1402230a4
mov rax, qword [rax]
test rax, rax
jne 0x140223095
xor eax, eax
test rax, rax
je 0x1402230b4
test r8, r8
je 0x1402230b4
mov ecx, dword [rax + 0xc]
mov dword [r8], ecx
mov rbx, qword [rsp + 8]
ret

Function at 0x140226eec
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1403fe28c]
xor edx, edx
jmp fcn.14021c32c

Function at 0x1402271cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x1402271e4
movsxd rcx, dword [r11]
xor edx, edx
mov r10, qword [r11 + 8]
mov rax, r9
div rcx
movsxd r9, edx
xor edx, edx
mov rcx, qword [r10 + r9*8]
test rcx, rcx
je 0x140227234
mov rax, qword [rbx]
cmp qword [rcx + 8], rax
je 0x140227255
mov rdx, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140227223
xor ecx, ecx
test rcx, rcx
je 0x14022726c
test r8, r8
je 0x140227247
mov rdx, qword [rcx + 0x10]
mov qword [r8], rdx
mov edx, 0x18
call fcn.14020f630
mov al, 1
jmp 0x14022726e
mov rax, qword [rcx]
test rdx, rdx
jne 0x140227263
mov qword [r10 + r9*8], rax
jmp 0x140227266
mov qword [rdx], rax
dec dword [r11 + 4]
jmp 0x140227236
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1402278c0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1403fe28c]
jmp fcn.14021c32c
Function at 0x14022821c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rdx + r10]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140228234
movsxd rcx, dword [rbx]
xor edx, edx
mov rax, r9
div rcx
mov rax, qword [rbx + 8]
movsxd rcx, edx
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x14022827f
mov rcx, qword [r11]
cmp qword [rax + 8], rcx
je 0x140228281
mov rax, qword [rax]
test rax, rax
jne 0x140228271
xor eax, eax
test rax, rax
je 0x140228292
test r8, r8
je 0x140228292
mov rcx, qword [rax + 0x10]
mov qword [r8], rcx
mov rbx, qword [rsp + 8]
ret

Function at 0x140228618
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
xor esi, esi
test dword [0x1403c9ce8], 0x80000000
je 0x140228654
mov ecx, dword [0x1403fe28c]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
jne 0x14022865c
call fcn.140222b78
mov rbx, rax
cmp qword [rbx + 0x40], rsi
jne 0x14022866a
mov rcx, rbx
call fcn.140226efc
mov rax, qword [rbx + 0x40]
mov ecx, dword [rax + 0xa0]
cmp rbx, qword [rdi + 0x18]
jne 0x140228687
cmp ecx, dword [rdi + 0xd0]
jne 0x140228687
mov rax, rdi
jmp 0x1402286fd
mov rcx, rbx
call fcn.140227314
test rax, rax
je 0x14022869d
cmp qword [rax + 0xa8], rdi
je 0x1402286fd
mov rdx, rdi
mov rcx, rbx
call fcn.140228298
test rax, rax
jne 0x1402286fd
mov ecx, 0xe8
call fcn.140070968
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1402286d2
mov r8b, 1
mov rdx, rdi
mov rcx, rax
call fcn.140227db8
mov rsi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov rcx, rbx
call fcn.1402278d8
lea rcx, [rbx + 0xd0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call fcn.140228320
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140228710
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x140228744
test dword [0x1403c9ce8], 0x80000000
je 0x14022873b
mov ecx, dword [0x1403fe28c]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x140228740
call fcn.140222b78
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.140233c88
test al, al
je 0x140228790
mov edx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shl edx, 4
sar edx, 4
test edx, edx
js 0x140228770
mov rcx, rax
call fcn.140226af8
mov edx, 3
jmp 0x14022877c
lock inc dword [rax + 0xc4]
mov edx, 2
mov rcx, rbx
call fcn.140233c24
mov rcx, qword [rbx + 0x18]
mov rdx, rbx
call fcn.140226ba4
add rsp, 0x20
pop rbx
ret

Function at 0x14022aff4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
xor ebx, ebx
mov ecx, dword [rax + 0xb0]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x14022b015
test al, 3
cmove rbx, rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14024f5f4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1402543d8
test al, al
je 0x14024f62c
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x14024f62c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.14024f640
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14024f724
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14024f4f8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14024f4f8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14024f4f8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14024f4f8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14024f4f8
cmp dword [rcx + 0x84], 0xe
jbe 0x14024f4f8
cmp dword [rcx + 0xf8], esi
je 0x14024f4f8
mov ecx, r14d
call fcn.14024f640
mov ecx, 2
call fcn.14024da18
nop
cmp byte [0x1403fe840], 0
jne 0x14024f5c2
mov r15d, 1
mov eax, r15d
xchg dword [0x1403fe834], eax
test ebx, ebx
jne 0x14024f56b
mov rdi, qword [0x1403c9cb8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1403fe838]
cmp rcx, rax
je 0x14024f562
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14009d050]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1403fe850]
jmp 0x14024f577
cmp ebx, r15d
jne 0x14024f57d
lea rcx, [0x1403fe868]
call fcn.14024fb74
nop
test ebx, ebx
jne 0x14024f594
lea rdx, [0x14028a4c8]
lea rcx, [0x14028a4a0]
call fcn.14024f3b8
lea rdx, [0x14028a4d8]
lea rcx, [0x14028a4d0]
call fcn.14024f3b8
movzx eax, byte [0x1403fe840]
test esi, esi
cmove eax, r15d
mov byte [0x1403fe840], al
jmp 0x14024f5c2
mov ecx, 2
call fcn.14024da78
test esi, esi
jne 0x14024f5d9
mov ecx, r14d
call fcn.14024f5f4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14024f488
Function at 0x14025d488
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14025d4b6
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x14025d50b
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x54]
xor edx, edx
lea ecx, [r9 - 1]
mov eax, ecx
lea r8, [r9 - 1]
and eax, edi
and ecx, ebx
add eax, ecx
not r8
dec rax
and r8, rbx
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add eax, ecx
je 0x14025d50b
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x14025d4fd
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret

Function at 0x14025d51c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov r11, rdx
mov rbx, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14025d58f
mov r9d, dword [r8 + 0xf0]
xor edx, edx
test r9d, r9d
je 0x14025d58f
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
movzx r10d, word [r8 + 6]
add rcx, rax
mov r9d, dword [r9 + rdi + 0xc]
test r10d, r10d
je 0x14025d58f
mov eax, dword [rcx + 0xc]
cmp r9d, eax
jb 0x14025d584
mov r8d, dword [rcx + 8]
add eax, r8d
cmp r9d, eax
jb 0x14025d59c
inc edx
add rcx, 0x28
cmp edx, r10d
jb 0x14025d570
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov dword [rbx], r8d
mov eax, dword [rcx + 0x24]
mov dword [r11], eax
mov eax, dword [rcx + 0xc]
add rax, rdi
jmp 0x14025d591

Function at 0x1800044b0
Capabilities:
Encode data using xor

Disassembly:
fistp qword [rbp + rbp + 0x49a81f28]
invalid
fist dword [rax - 0x58]
stosb byte [rdi], al
add dword [rdi - 7], eax
jne 0x180004452
pushfq
mov eax, 0x4e881a84
add byte [rax + 0x7b], dl
or ch, cl
movsb byte [rdi], byte [rsi]
sub al, 0
lodsb al, byte [rsi]
pop rdi
xchg edx, ecx
leave
test dword [rsi + 0x1fa01364], ebp
invalid
Function at 0x140001ff8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14004de28]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov qword [rsp + 0x48], rsi
movdqa xmm0, xmmword [0x14003b930]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rdx, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
inc rdx
lea rcx, [rsp + 0x20]
call fcn.1400013c4
nop
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub r8, rdx
sar r8, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbx, qword [rsp + 0x20]
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov rcx, rbx
call fcn.14002ae3c
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call fcn.1400012bc
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400020e3
mov rax, qword [rsp + 0x30]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002105
call fcn.140025a4c
nop
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140025b60
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14002adc4
nop
int3

Function at 0x140003608
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14000362e
movzx r9d, byte [rdx]
inc rdx
movzx eax, cl
xor r9, rax
shr ecx, 8
lea rax, [0x14004e8b0]
xor ecx, dword [rax + r9*4]
sub r8, 1
jne 0x14000360d
mov eax, ecx
ret

Function at 0x140003634
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x14000367b
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
test cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140003649
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140003640
ret

Function at 0x1400044e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x140004517
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x140004503
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003b4b0]
cmp byte [rbx + 0x21], 0
je 0x140004517
lea rcx, [rbx + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.140005790
xor al, al
add rsp, 0x20
pop rbx
ret