joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1409f28bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
jmp 0x1409f2962
mov edi, 0x178e617b
mov r11w, ax
xchg byte [rsp + 0xa], dl
pop di
jmp 0x1409f2949
mov word [rsp + 4], r12w
xchg word [rsp + 5], r9w
xchg dword [rsp + 6], r11d
push qword [rsp + 8]
mov r8b, r13b
mov qword [rsp], r12
jmp 0x1409f28fe
mov byte [rsp + 9], r14b
pop word [rsp + 6]
push word [rsp]
jmp 0x1409f2993
xchg word [rsp + 0xb], bx
mov r13w, dx
ror ax, 3
xchg r9d, edx
jmp 0x1409f2933
bswap r11
mov r13d, dword [rsp + 7]
push word [rsp + 5]
setbe bpl
xchg dword [rsp + 5], r8d
mov ecx, r14d
jmp 0x1409f2914
xchg bpl, r8b
mov edx, 0xd1c1c2fd
mov dl, byte [rsp]
mov dword [rsp + 0xc], ebx
jmp 0x1409f29a9
mov r11d, dword [rsp + 2]
ror r11b, 2
mov al, 0xb
bswap r9
bsf ax, cx
xchg rcx, rax
jmp 0x1409f297d
bswap rdi
xchg byte [rsp + 0xc], r14b
pop rbx
mov rcx, rsp
xchg qword [rsp], r8
jmp 0x1409f2a05
mov edi, 0x54393f65
bswap r13d
stc
mov r14d, dword [rsp + 0xa]
dec bx
jmp 0x1409f29d5
xchg byte [rsp + 7], r15b
xchg dword [rsp + 3], ebx
mov byte [rsp + 3], bl
push word [rsp + 2]
xchg di, r14w
xchg r13d, ebx
jmp 0x1409f29eb

Function at 0x1409f2ca7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rbp, [r9 + riz + 0xcaeb]
xchg r11b, r12b
mov r8w, r15w
jmp 0x1409f2c47
push qword [rsp + 1]
neg r14b
mov word [rsp + 0x16], si
rdtsc
rdtsc
setne r8b
jmp 0x1409f2bfa
mov r11d, 0x874dacb3
not r13
inc rax
pop qword [rsp]
pop r11w
rdtsc
jmp 0x1409f2c10
mov r10, qword [rsp + 9]
mov r14w, r13w
add rsp, 0xa
mov edx, r15d
lea r13, [rcx + r11]
pop qword [rsp]
jmp 0x1409f2c87
xchg word [rsp + 0x20], r15w
lea rsp, [rsp + 0xd]
push word [rsp + 0x1d]
xchg dword [rsp + 0x10], r8d
setg r14b
mov rbp, qword [rsp + 3]
jmp 0x1409f2c2f
mov word [rsp], sp
call fcn.1409f2cc6
mov dword [rsp + 8], r8d
mov ecx, r11d
xchg r8b, r12b
bswap r10
jmp 0x1409f2cb0
mov r13, 0xffffffff9bdd6c40
jmp 0x1409f2c67
mov word [rsp + 1], bx
stc
mov r8d, r11d
or ebp, edx
mov r11b, r14b
jmp 0x1409f2d3f
push word [rsp + 0x11]
dec r11d
xchg qword [rsp + 0xb], r12
jmp 0x1409f2d10
mov r13d, r15d
mov r8w, bp
mov rdx, 0xfffffffff5cf4e7a
pop word [rsp + 3]
sub rsp, 0
mov r15, qword [rsp + 0x10]
jmp 0x1409f2d26

Function at 0x1409f2d5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r11, [rcx + rcx]
bsf di, r12w
xchg byte [rsp], r15b
rcr rbx, 0x15
mov r10w, cx
jmp 0x1409f2d8f
Function at 0x1409f2eb2
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [rsp + 2], r12d
mov ebx, 0x6613afb7
mov edi, dword [rsp]
jmp 0x1409f311f
bsr r9w, r14w
mov r10b, 0x44
pop r9
jmp 0x1409f2e9c
lea r9, [r9 + r9]
xchg dword [rsp + 0xd], r11d
shl ecx, cl
xchg dword [rsp + 0xd], r8d
mov r13, qword [rsp + 2]
jmp 0x1409f2fe2
xchg r9w, dx
clc
push r10
mov word [rsp + 0xf], r11w
pop r13w
xchg qword [rsp + 0xb], r15
jmp 0x1409f2eec
mov r15b, r12b
push qword [rsp]
dec di
lea rsp, [rsp + 9]
cld
jmp 0x1409f2fb2
mov rbx, r11
bsf bp, bx
not dx
bsf rcx, r11
xchg r15w, ax
mov dword [rsp + 8], ebx
jmp 0x1409f2f20
setno r9b
mov r15, 0xffffffffd9f0c37e
mov byte [rsp + 0x14], r14b
pop word [rsp + 8]
dec r12b
bswap r9d
jmp 0x1409f2f36
mov ebp, r10d
call fcn.1409f2fc8
pop rsp
invalid
xchg edi, ecx
pop qword [rsp + 3]
mov cl, 0x84
pop r10
mov dl, 0x2f
mov dl, 0xf
jmp 0x1409f2f7d
mov word [rsp + 5], si
mov byte [rsp + 0x11], dl
xchg dx, di
rdtsc
lea r14, [rbx + rbx]
rdtsc
jmp 0x1409f2f93
and r9b, 0xd5
mov ebp, dword [rsp + 0xe]
neg r14b
mov dword [rsp + 0x13], r10d
cmp ecx, r9d
mov r9d, dword [rsp + 0xc]
jmp 0x1409f2f60
bswap rax
pop word [rsp + 4]
sub rsp, 9
mov dx, di
push qword [rsp + 0x10]
bsf rax, r10
jmp 0x1409f2f08
mov byte [rsp + 6], r10b
dec r14d
mov byte [rsp + 8], r13b
sete r9b
sub rsp, 4
add rsp, 3
jmp 0x1409f3092

Function at 0x1409f42c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp dword [0x14068202b], 0
jmp 0x1409e68d8
std
add rsp, 0x10
pop qword [rsp + 0x13]
sub rsp, 0x15
jmp 0x1409e3879
inc dword [0x14068202b]
pushfq
cld
sub rsp, 0x1f
sub rsp, 0x15
jmp 0x1409e383b
cld
push qword [rsp + 2]
mov qword [rsp + 3], r11
add rsp, 1
jmp 0x1409e38be
lea rsp, [rsp + 1]
lea rsp, [rsp + 0x30]
stc
cmc
sub rsp, 9
push word [rsp + 3]
jmp 0x1409e3863
lea rsp, [rsp + 2]
mov qword [rsp], r13
call fcn.1409e38a6
lea rsp, [rsp + 0x10]
jmp 0x1409e6973
je 0x1409e3851
jne 0x1409e68c2
ret 0x3750
add rsp, 8
call fcn.1409e6928
call 0x1409f4045
jmp 0x1409f432b
jmp 0x1409f42d6
pop word [rsp + 3]
push r9
push word [rsp + 0xa]
jmp 0x1409f4311
mov rax, qword [rax + riz + 0x30]
jmp 0x1409f4341
lea rsp, [rsp + 7]
lea rsp, [rsp + 0x20]
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
jmp 0x1409f42fb
pop rax
jmp 0x1409f4350
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x1409f4040
sub rax, 0x9f4045
push rax
jmp 0x1409e37e0
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14025a048]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x30]
mov r15d, edx
mov ebp, ecx
mov r8, qword [rax + 0x60]
mov r14, qword [r8 + 0x18]
add r14, 0x20
mov rbx, qword [r14]
cmp rbx, r14
je 0x140001173
nop dword [rax]
cmp word [rbx + 0x48], 0x3f
jae 0x140001167
mov r9, qword [rbx + 0x50]
xor r11d, r11d
xor r10d, r10d
cmp word [r9], r10w
je 0x1400010ac
nop dword [rax + rax]
cmp r11d, 0x3f
jae 0x1400010a2
movzx edx, word [r9]
movzx r8d, dl
cmp edx, 0x61
lea eax, [r8 - 0x20]
movzx ecx, al
cmovb ecx, r8d
add r9, 2
mov byte [rsp + r10 + 0x20], cl
inc r11d
inc r10
cmp word [r9], 0
jne 0x140001070
cmp r10, 0x40
jae 0x1400011aa
mov byte [rsp + r10 + 0x20], 0
lea rcx, [rsp + 0x20]
movzx eax, byte [rsp + 0x20]
mov edx, 0x811c9dc5
test al, al
je 0x1400010e6
nop word [rax + rax]
movzx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x1400010d0
cmp edx, r15d
jne 0x140001167
mov r10, qword [rbx + 0x20]
movsxd rax, dword [r10 + 0x3c]
movsxd rcx, dword [rax + r10 + 0x88]
add rcx, r10
movsxd rax, dword [rcx + 0x20]
test eax, eax
je 0x140001167
movsxd rdi, dword [rcx + 0x24]
lea r8, [r10 + rax]
movsxd rsi, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add rsi, r10
xor r9d, r9d
test r11d, r11d
je 0x140001167
nop dword [rax]
nop dword [rax + rax]
movsxd rax, dword [r8]
mov edx, 0x811c9dc5
add rax, r10
movzx ecx, byte [rax]
test cl, cl
je 0x140001157
inc rax
movzx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140001142
cmp edx, ebp
je 0x14000119c
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140001130
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140001050
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140245370
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [rdi + r9*2]
movsxd rax, dword [rsi + rcx*4]
add rax, r10
jmp 0x140001175
call fcn.1402450e0
int3
Function at 0x140247718
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140247544
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [rsi + 0x42]
call qword [rbx + 0x42]
call qword [r8 + 0x40]
call qword [r10 + 0x3e]
call qword [r14 + 0x3f]
call qword [r15 + 0x42]
call qword [r14 + 0x43]
call qword [r15 + 0x43]
call qword [r15 + 0x43]
call qword [r15 + 0x43]
call qword [r15 + 0x42]
call qword [r14 + 0x41]
call qword [r13 + 0x3f]
call qword [r10 + 0x3e]
call qword [rcx + 0x40]
call qword [rcx + r8*2 + 0x42]
call qword [rbx + 0x40]
invalid
invalid
invalid
and edi, edi
invalid
and bh, bh
and dword cs:[rdx], esp
jmp [rsi]
xor byte [rdx], ah
and edi, edi
sub al, 0x20
and bh, bh
sub bl, byte [rsi]
invalid
sub dword [0x15c2bf617], ebx
sbb al, 0xff
sbb ebx, dword es:[rbx]
jmp qword [rdx + rbx]
Function at 0x140001000
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
xor ebx, ebx
mov r14d, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
mov qword [rsp + 0x50], rax
cmp rax, rdi
je 0x1400010d4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400010d4
mov ecx, esi
call fcn.140002948
mov r14, rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x5c]
mov r8d, esi
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400010d4
mov dword [rsp + 0x40], ebx
cmp ebx, esi
jae 0x1400010d4
mov eax, ebx
movzx ecx, byte [rax + r14]
imul ecx, ebx
imul eax, ecx, 0x7f7f7f80
mov ecx, esi
sub ecx, eax
xor edi, ecx
mov dword [rsp + 0x58], edi
inc ebx
jmp 0x1400010ae
lea rdx, [r15 - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400010e7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400010f4
mov rcx, r14
call fcn.140002940
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002920
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001eb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, rcx
mov rsi, rdx
lea rcx, str.Injecting__s.._n
call fcn.140001130
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rsi
mov dword [rsp + 0x40], ebp
lea r8d, [rbp + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140001f6e
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x140001f65
mov ecx, r14d
call fcn.140002948
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001fa8
mov rcx, rbx
call fcn.140002940
mov ebp, 0x8123
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
lea rcx, str.Unable_to_load_find__s_n
call fcn.140001130
mov rcx, rbp
call fcn.140002940
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002920
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rbx
mov rcx, r15
call fcn.140001190
test al, al
jne 0x140001fd4
mov rdx, rsi
lea rcx, str.Failed_to_inject__s_n
call fcn.140001130
mov rcx, rbx
jmp 0x140001f80
mov rcx, rbx
call fcn.140002940
mov rdx, rsi
lea rcx, str._s_successfully_injected__n
call fcn.140001130
mov eax, 1
jmp 0x140001f87
Function at 0x140018ba0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r13d, edx
mov edx, 0xffffffec
mov ebp, r8d
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, rdi
movsxd r14, eax
call qword [sym.imp.USER32.dll_GetParent]
xor r15d, r15d
lea rdx, [rsp + 0x68]
mov rcx, rdi
mov r12, rax
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x6c], r15d
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x74], r15d
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0xd8]
mov rcx, r12
mov dword [rsp + 0xd8], r15d
mov dword [rsp + 0xdc], r15d
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8d, dword [rsp + 0xdc]
mov edx, dword [rsp + 0xd8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_OffsetRect]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
movsxd rbx, eax
lea ecx, [rbx + 0x1b]
movsxd rdx, ecx
lea rcx, [rsp + 0x60]
call fcn.1400616e0
mov rsi, qword [rsp + 0x60]
lea r8d, [rbx + 0xb]
mov rdx, rsi
mov rcx, rdi
mov word [rsi], r15w
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rax, qword [rsp + 0x60]
lea edx, [r15 + 0x31]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov word [rax + rbx*2 + 0x14], r15w
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0xd0]
mov r15, rax
or eax, 0xffffffff
lea r8, [rsp + 0xc0]
mov edx, 0xb0
mov rcx, rdi
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0xd0], eax
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
test ebp, ebp
jns 0x140018cd7
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rsp + 0x58], 0
mov r9d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x74]
mov rax, qword [0x140132f48]
mov qword [rsp + 0x50], rax
sub r8d, r9d
movzx edx, bp
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], r12
sub r10d, r11d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r9d
lea rdx, [0x140115b88]
xor r8d, r8d
mov r9d, r13d
mov ecx, r14d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r9d, 1
mov r8, r15
lea edx, [r9 + 0x2f]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9d, dword [rsp + 0xd0]
mov r8d, dword [rsp + 0xc0]
mov edx, 0xb1
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x60]
call fcn.1400590a4
mov rax, rbx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003bfb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rdi, rcx
mov esi, edx
lea rcx, [rsp + 0x40]
mov edx, 0x20a
call fcn.1400616e0
mov rax, qword [rsp + 0x40]
mov ebx, 0x20
mov word [rax], bx
mov rax, qword [rsp + 0x40]
xor r12d, r12d
mov word [rax + 2], r12w
mov rdx, qword [rsp + 0x40]
lea rcx, str.SystemRoot
add rdx, 2
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.System32OnShutdown.wcs
lea rcx, [rsp + 0x40]
call fcn.1400617a8
test bl, sil
lea r11, str.unknown
lea rax, [0x140114320]
lea rcx, str.reboot
lea rbx, str.lock
cmove rax, r11
test sil, 0x10
cmove rcx, rax
test sil, 2
lea rax, [0x140118f48]
cmove rax, rcx
test sil, 4
lea rcx, str.suspend
cmove rcx, rax
test sil, 8
lea rax, str.hiber
cmove rax, rcx
test sil, 0x40
lea rcx, str.poweroff
cmove rcx, rax
test sil, 0x80
cmove rbx, rcx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
mov rdx, rbx
movsxd rbp, eax
call fcn.1400617a8
lea rdx, [0x140114460]
lea rcx, [rsp + 0x40]
call fcn.1400617a8
cmp rdi, r12
je 0x14003c0ca
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1400617a8
mov rdx, qword [rsp + 0x40]
lea rcx, [0x1401330e0]
call fcn.140030b40
lea rdx, str._25INDATA
lea rcx, [rsp + 0x50]
call fcn.14006d600
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
lea rdx, [rax + rbp*2]
call fcn.1400617a8
test sil, 0x70
je 0x14003c116
mov rdx, qword [rsp + 0x50]
lea rcx, [0x1401330e0]
call fcn.140030b40
lea rcx, [rsp + 0x50]
call fcn.1400590a4
lea rcx, [rsp + 0x40]
call fcn.1400590a4
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140017ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140017e34
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140017e34
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x140017d3b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140017e5b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140017d52
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140017d52
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140017d65
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140017db2
mov r8d, eax
cmp eax, 0x800
jae 0x140017d7f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140017db2
cmp eax, 0x10000
jae 0x140017d99
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140017db2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140017e34
add qword [r14], 2
test sil, sil
jne 0x140017dd3
cmp r10d, 3
jae 0x140017ddf
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140017e11
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140017df0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x140017cef
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140017e42
Function at 0x140005180
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14006ee70]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x140093e10]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3edc], ebx
jne 0x140005216
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.1400173b0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140011190
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140093e10]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x1400111f1
cmp byte [rbx + 0x424e], 0
jne 0x1400111f1
movsx r9d, word [rbx + 0x532e]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002990
test dil, 1
je 0x140011318
jmp 0x14001127a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x532e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400782e4]
mulss xmm1, dword [0x1400782d8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x14007814c]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.140002990
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400112d0
lea r11, [0x14006ee70]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400112b3
cmp byte [r8], r9b
jne 0x1400112b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400112a0
not ecx
call fcn.14000a190
test rax, rax
je 0x140011318
cmp byte [rax + 0x96], 0
je 0x140011318
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x532e]
mov edx, 0x10
movsx r9d, word [rbx + 0x532e]
call fcn.140002990
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c8b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d0d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140016010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400160b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001606a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018020
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003110
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140093e08]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400160bf
mov rcx, rbx
call fcn.140003110
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret