joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003210
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400032e3
cmp byte [rcx + 0x71], 0
je 0x1400032e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400032df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400032a4
sub eax, 1
je 0x1400032a8
cmp eax, 2
jne 0x1400032df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400036e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400032d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400032df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000328c
xor al, al
jmp 0x14000328c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400036e0
add rsp, 0x60
pop rbx
ret

Function at 0x140004058
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400040a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400040a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400040a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400040a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400040a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400040a4
xor al, al
add rsp, 0x28
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40ea8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x141692d60
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141692ee7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141692d91
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141692d77
add dl, dl
jne 0x141692d9e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141692dfe
xor eax, eax
add dl, dl
jne 0x141692dad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141692eb5
add dl, dl
jne 0x141692dbe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141692dcb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141692dd8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141692de5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141692df2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141692d86
mov eax, 1
add dl, dl
jne 0x141692e0e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141692e1b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141692e03
sub eax, ebx
mov ebx, 1
jne 0x141692e54
mov ecx, 1
add dl, dl
jne 0x141692e36
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141692e43
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141692e2b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141692d86
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141692e70
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141692e7d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141692e65
cmp eax, 0x7d00
jae 0x141692ea3
cmp eax, 0x500
jb 0x141692e9e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141692d86
cmp eax, 0x7f
ja 0x141692ea6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141692d86
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141692eda
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141692d86
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140f98058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f981df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f98089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f9806f
add dl, dl
jne 0x140f98096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f980f6
xor eax, eax
add dl, dl
jne 0x140f980a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f981ad
add dl, dl
jne 0x140f980b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f980c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f980d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f980dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f980ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f9807e
mov eax, 1
add dl, dl
jne 0x140f98106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f98113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f980fb
sub eax, ebx
mov ebx, 1
jne 0x140f9814c
mov ecx, 1
add dl, dl
jne 0x140f9812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f9813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f98123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f98168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f98175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f9815d
cmp eax, 0x7d00
jae 0x140f9819b
cmp eax, 0x500
jb 0x140f98196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9807e
cmp eax, 0x7f
ja 0x140f9819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f9807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f981d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f9807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400017c4
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140000400]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rax, qword gs:[0x30]
xor edi, edi
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov eax, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x18]
mov r13d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r13, rbx
mov ecx, dword [rcx + 0x24]
add rdx, rbx
add rcx, rbx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
test eax, eax
je 0x140001980
cmp dword [r13 + rdi*4], 0
je 0x140001974
mov r12d, dword [r13 + rdi*4]
xor r14d, r14d
test r8d, r8d
je 0x140001974
mov r15, rdx
mov rbp, rcx
movzx eax, word [rbp]
cmp eax, edi
jne 0x140001956
mov esi, dword [r15]
lea rdx, [0x140000670]
lea rcx, [rsp + 0x58]
add rsi, rbx
call fcn.140001ba0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x38]
call fcn.140001668
cmp qword [rax + 0x18], 0xf
jbe 0x1400018b5
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
mov rdx, qword [rsp + 0x50]
mov esi, eax
cmp rdx, 0xf
jbe 0x140001900
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018fb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019b0
call fcn.14000266c
and qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
cmp rdx, 0xf
jbe 0x14000194d
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019b0
call fcn.14000266c
test esi, esi
je 0x1400019b7
mov r8d, dword [rsp + 0x20]
inc r14d
add rbp, 2
add r15, 4
cmp r14d, r8d
jb 0x140001879
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
inc edi
cmp edi, dword [rsp + 0x24]
jb 0x140001856
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400023d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [r12 + rbx]
jmp 0x140001982

Function at 0x140002394
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
jmp 0x14000239c
movzx eax, byte [rdx]
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret
Function at 0x140002f0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f56
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f58
xor al, al
add rsp, 0x28
ret
Function at 0x140034316
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140044e10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400ba0ff]
call fcn.14003521b
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x140044e4e
mov rcx, qword [rbp + 0x100]
call fcn.1400343a7
nop
jmp 0x140044e6a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x140044e6a
mov rcx, qword [rbp + 0x100]
call fcn.1400348d4
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400348d4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140048c90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400ba0ff]
call fcn.14003521b
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x140048cd5
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x140048d66
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x140048d2b
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140048d35
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140048cca
mov qword [rbp + 0x88], 0xe3
jmp 0x140048d84
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x140048e2d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x140048de9
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140048df3
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140048d73
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x140048e8d
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x140048e97
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1400349ab
Capabilities:
Create thread
Inject thread

Disassembly:
jmp 0x14004d540
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x40]
lea rcx, [0x1400ba122]
call fcn.14003521b
nop
mov r8d, dword [rbp + 0x158]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14004d662
mov rcx, qword [rbp + 0x150]
call fcn.140034d16
inc rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14004d657
mov rcx, qword [rbp + 0x150]
call fcn.140034d16
inc rax
mov qword [rbp + 0x118], rax
mov rcx, qword [rbp + 0x150]
call fcn.1400341b8
mov qword [rbp + 0x120], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x118]
mov r8, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x14004d657
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400349b5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14004d360
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x82
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x308]
mov rax, qword [0x1400af040]
xor rax, rbp
mov qword [rbp + 0x2b8], rax
lea rcx, [0x1400ba122]
call fcn.14003521b
nop
xor edx, edx
mov ecx, 2
call fcn.14003486b
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x130
mov dword [rbp + 0x174], 0
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14004d4a1
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140034efb
test eax, eax
je 0x14004d496
lea rcx, [rbp + 0x294]
call fcn.1400349ba
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x5c]
call fcn.1400347f3
lea rax, [rbp + rax + 0x5c]
mov qword [rbp + 0x2b0], rax
mov r9, qword [rbp + 0x2a8]
mov r8, qword [rbp + 0x2b0]
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x198]
call fcn.1400351bc
nop
lea rdx, [rbp + 0x198]
mov rcx, qword [rbp + 0x2e0]
call fcn.1400344b0
movzx eax, al
test eax, eax
je 0x14004d474
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x174], eax
lea rcx, [rbp + 0x198]
call fcn.140034faa
nop
jmp 0x14004d496
lea rcx, [rbp + 0x198]
call fcn.140034faa
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140035239
test eax, eax
jne 0x14004d3fb
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x174]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400a2240]
call fcn.140034f14
mov eax, edi
mov rcx, qword [rbp + 0x2b8]
xor rcx, rbp
call fcn.14003489d
lea rsp, [rbp + 0x2c8]
pop rdi
pop rbp
ret

Function at 0x140034a19
Capabilities:
Terminate process

Disassembly:
jmp 0x140097640
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140034ba4
Capabilities:
Get geographical location

Disassembly:
jmp 0x140091b10
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140091b4d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400351fd
add rsp, 0x58
ret
Function at 0x140034c76
Capabilities:
Parse pe header

Disassembly:
jmp 0x140098990
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400989b0
xor al, al
jmp 0x140098a31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400989c3
xor al, al
jmp 0x140098a31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400989ed
xor al, al
jmp 0x140098a31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140098a01
xor al, al
jmp 0x140098a31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140098a13
xor al, al
jmp 0x140098a31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140098a2f
xor al, al
jmp 0x140098a31
mov al, 1
add rsp, 0x38
ret