joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400721a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x140072227
mov rbx, r15
mov rbp, r15
jmp 0x14007226a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140072241
cmp rbx, rcx
je 0x140072264
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140072233
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 0x10], rax
je 0x1400723cd
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.140075ef8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xor eax, eax
mov dword [rdi + 0x14], eax
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400722be
cvtsi2ss xmm0, rcx
jmp 0x1400722d3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400722e6
cvtsi2ss xmm1, rcx
jmp 0x1400722fb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140072365
mov rcx, rsi
call fcn.1400724e0
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x140072338
mov qword [rsp + 0x28], 0
jmp 0x140072358
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140072355
mov rbx, rax
cmp rax, rdx
je 0x140072399
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140072344
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x1400723a9
mov qword [rcx + rax*8], rdi
jmp 0x1400723bb
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x14007235d
cmp r8, rbp
jne 0x1400723b4
mov qword [rcx + rax*8], rdi
jmp 0x1400723c0
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1400723c0
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140072249
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140072590
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140072694
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140075f34
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400726a0
cmp rbx, rbp
jne 0x140072640
cmp qword [rsp + 0x20], r14
jne 0x14007266d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400726af
mov qword [r15], r12
mov rax, r12
jmp 0x1400726b2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14007266d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140075f34
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140072746
cmp rbx, rbp
jne 0x140072720
jmp 0x14007266a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400726c0
jmp 0x14007266d
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007280c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14007279a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x140072590
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400727da
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140075f34
mov rcx, rbx
test rbx, rbx
jne 0x1400727c0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140014040
add rsp, 0x30
pop rdi
ret
Function at 0x140072760
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140072694
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140075f34
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400726a0
cmp rbx, rbp
jne 0x140072640
cmp qword [rsp + 0x20], r14
jne 0x14007266d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400726af
mov qword [r15], r12
mov rax, r12
jmp 0x1400726b2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14007266d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140075f34
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140072746
cmp rbx, rbp
jne 0x140072720
jmp 0x14007266a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400726c0
jmp 0x14007266d
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007280c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14007279a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x140072590
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400727da
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140075f34
mov rcx, rbx
test rbx, rbx
jne 0x1400727c0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140014040
add rsp, 0x30
pop rdi
ret
Function at 0x140072be0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, qword [r9 + 8]
je 0x140072c60
mov eax, dword [r10]
mov r8, qword [rdx]
cmp eax, dword [rcx + 0x10]
je 0x140072c62
nop
cmp rcx, r8
je 0x140072c60
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140072c50
jmp 0x140072c62
xor ecx, ecx
test rcx, rcx
je 0x140072cc1
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140072c8c
cmp rax, rcx
jne 0x140072c82
mov rax, qword [r9 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140072c97
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
jmp 0x140072c97
cmp rax, rcx
jne 0x140072c97
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r9 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140075f34
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140075070
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400a3580]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rbx, rcx
call sub.MSVCP140.dll__Thrd_id
mov edx, eax
movabs r9, 0x100000001b3
movzx r8d, al
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, edx
imul r8, r9
shr eax, 8
movzx ecx, al
mov eax, edx
xor r8, rcx
shr eax, 0x10
imul r8, r9
movzx ecx, al
mov eax, dword [rbx + 0x60dc]
xor r8, rcx
imul r8, r9
shr rdx, 0x18
xor r8, rdx
imul r8, r9
cmp rax, r8
je 0x140075105
movzx eax, byte [rbx + 0x60d8]
nop
test al, al
jne 0x140075105
mov eax, 1
lea rcx, [rbx + 0x60e0]
xchg byte [rbx + 0x60d8], al
call sub.MSVCP140.dll__Cnd_broadcast
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140076050
add rsp, 0x30
pop rbx
ret

Function at 0x140075300
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140075361
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140075320
mov ecx, dword [r9]
jmp 0x140075448
cmp ecx, 0x4e0
jb 0x140075448
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140075380
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400753d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140075710
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400a87b0], 0
lea rsi, [0x1400a21e0]
mov qword [rsp + 0x40], r14
mov edi, edx
mov r14d, ecx
jne 0x140075819
mov byte [0x1400a87b0], 1
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
mov r9, rax
cmp rbx, 0x989680
jne 0x140075760
imul rax, r9, 0x64
jmp 0x1400757dd
cmp rbx, 0x16e3600
jne 0x1400757bf
movabs r10, 0xb2f4fc0794908cf3
mov rax, r10
imul r9
mov rax, r10
lea r8, [r9 + rdx]
sar r8, 0x18
mov rcx, r8
shr rcx, 0x3f
add r8, rcx
imul rcx, r8, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, r8, 0x3b9aca00
add rax, rdx
jmp 0x1400757dd
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov rcx, rax
mov dword [0x1400a21e4], eax
mov edx, 1
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [rsi + rdx*4 + 4], ecx
inc rdx
cmp rdx, 0x270
jb 0x1400757f0
mov dword [0x1400a21e0], 0x270
mov ebp, 0x80000000
mov qword [rsp + 0x50], rsi
cmp r14d, ebp
lea eax, [r14 - 0x80000000]
lea esi, [r14 + rbp]
mov r14, qword [rsp + 0x40]
cmovae esi, eax
lea ecx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ecx, eax
sub ecx, esi
cmp ecx, 0xffffffff
jne 0x14007585c
lea rcx, [rsp + 0x50]
call fcn.140075300
mov ecx, eax
jmp 0x14007589b
lea edi, [rcx + 1]
lea rcx, [rsp + 0x50]
mov ebx, edi
call fcn.140075300
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x140075897
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x140075897
lea rcx, [rsp + 0x50]
call fcn.140075300
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x140075883
shr rcx, 0x20
mov rbx, qword [rsp + 0x48]
lea edx, [rsi + rcx]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140076d00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140076d4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140076d4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140076d4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140076d4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140076d4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140076d4c
xor al, al
add rsp, 0x28
ret
Function at 0x140001d5c
Capabilities:
Bypass uac via rpc

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x150
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor edx, edx
mov sil, dl
mov qword [rax + 0x30], rdx
mov dword [rax + 0x40], edx
mov rbx, qword [rsp + 0x1b8]
test rbx, rbx
je 0x140001dac
mov qword [rbx], rdx
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rdx
lea rdi, [rsp + 0x88]
xor eax, eax
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rsp + 0x110]
lea ecx, [rax + 0x38]
rep stosb byte [rdi], al
mov dword [rsp + 0x134], 1
mov word [rsp + 0x138], dx
lea rdi, [rsp + 0xa0]
lea ecx, [rax + 0x70]
rep stosb byte [rdi], al
lea rdx, [rsp + 0x1b8]
lea rcx, str.201ef99a_7fa0_444c_9399_19ba84f12a1a
call fcn.140010424
test eax, eax
jne 0x140001f8e
lea edx, [rax + 0x70]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncInitializeHandle]
mov edi, eax
test eax, eax
jne 0x140001e4b
mov dword [rsp + 0xcc], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xd0], rax
test rax, rax
jne 0x140001e4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x140001f8e
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x68], rax
or dword [rsp + 0x60], 0xffffffff
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x110]
mov qword [rsp + 0x50], rax
lea rax, str.WinSta0Default
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r9, qword [rsp + 0x1b8]
lea r8, [rsp + 0xa0]
lea rdx, [0x140023eb2]
lea rcx, [0x140023e10]
call qword [sym.imp.RPCRT4.dll_NdrAsyncClientCall]
or edi, 0xffffffff
mov edx, edi
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x140001ef6
or ecx, 0xffffffff
call qword [sym.imp.RPCRT4.dll_RpcRaiseException]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncCompleteCall]
test eax, eax
jne 0x140001f56
cmp qword [rsp + 0x198], 0
jne 0x140001f56
test rbx, rbx
je 0x140001f4b
mov rax, qword [rsp + 0x88]
mov qword [rbx], rax
mov rax, qword [rsp + 0x90]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x98]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x9c]
mov dword [rbx + 0x14], eax
mov sil, 1
mov byte [rsp + 0x80], sil
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140001f72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0xd0], 0
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
jmp 0x140001f8e
mov al, sil
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140002754
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
xor r12d, r12d
mov r15, r9
mov rbx, rcx
mov r14d, r12d
mov ebp, r12d
mov rax, rcx
test rcx, rcx
jne 0x14000278f
mov eax, r12d
jmp 0x1400027a5
cmp word [rcx], r12w
je 0x14000279f
add rax, 2
cmp word [rax], r12w
jne 0x140002795
sub rax, rbx
sar rax, 1
lea r13, [0x1400276a8]
mov rcx, r13
add rcx, 2
cmp word [rcx], r12w
jne 0x1400027af
sub rcx, r13
mov edx, 8
sar rcx, 1
lea rdi, [rcx + 2]
mov rcx, qword [0x14002fa90]
add rdi, rax
mov rcx, qword [rcx + 0x18]
lea r8, [rdi + rdi]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x140002885
mov rdx, rbx
mov rcx, rax
call fcn.140001af4
mov r8, rdi
mov rdx, r13
call fcn.140010568
lea rdx, [rsp + 0x270]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov r13d, 1
cmp rax, 0xffffffffffffffff
je 0x14000285c
mov r8, r15
lea rdx, [rsp + 0x270]
mov rcx, rbx
call fcn.14000299c
test eax, eax
jne 0x140002850
lea rdx, [rsp + 0x270]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002822
jmp 0x140002853
mov ebp, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x14002fa90]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebp, ebp
je 0x14000287e
mov eax, r13d
jmp 0x14000297a
lea r13, [0x1400276a8]
mov rax, rbx
test rbx, rbx
jne 0x140002892
mov rax, r12
jmp 0x1400028a8
cmp word [rbx], r12w
je 0x1400028a2
add rax, 2
cmp word [rax], r12w
jne 0x140002898
sub rax, rbx
sar rax, 1
mov rcx, qword [0x14002fa90]
lea rsi, [rax + 0x108]
lea r8, [rsi + rsi]
mov edx, 8
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14000297a
mov rdx, rbx
mov rcx, rdi
call fcn.140001af4
mov r8, rsi
lea rdx, [0x1400273f8]
call fcn.140010568
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002961
test byte [rsp + 0x20], 0x10
je 0x140002946
cmp word [rsp + 0x4c], 0x2e
je 0x140002946
mov rdx, rbx
mov rcx, rdi
call fcn.140001af4
lea rdx, [rsp + 0x4c]
call fcn.140001ab8
lea r8, [fcn.14000299c]
mov rdx, r13
mov rcx, rdi
mov r9, r15
call fcn.140002754
mov r14d, eax
test eax, eax
jne 0x140002958
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002906
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x14002fa90]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, r14d
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000392c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xfa8]
mov eax, 0x1080
call fcn.1400176c0
sub rsp, rax
mov rbx, rcx
lea rdi, [rsp + 0x30]
xor esi, esi
lea rdx, [rsp + 0x50]
xor eax, eax
mov dword [rbp + 0xfc0], esi
mov dword [rbp + 0xfb8], esi
mov r15d, 0x1000
lea ecx, [rsi + 0x10]
rep stosb byte [rdi], al
mov eax, dword [rbx + 8]
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
lea ecx, [rsi + 0x38]
xor eax, eax
mov dword [rsp + 0x30], 0x30b0005
rep stosb byte [rdi], al
lea r14d, [rsi + 1]
mov dword [rsp + 0x34], InitCommonControls
lea rcx, str.367abb81_9844_35f1_ad32_98f038001003
mov dword [rsp + 0x38], 0x48
lea r12d, [rsi + 5]
mov qword [rsp + 0x40], 0x10001000
mov byte [rsp + 0x48], r14b
mov dword [rsp + 0x4c], 0x10000
mov dword [rsp + 0x74], 2
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x140003adb
lea rdx, [rsp + 0x64]
mov dword [rsp + 0x60], 2
lea rcx, str.8a885d04_1ceb_11c9_9fe8_08002b104860
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x140003adb
mov rcx, qword [rbx]
lea r9, [rbp + 0xfc0]
lea r8d, [rsi + 0x10]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140003adb
mov rcx, qword [rbx]
lea r9, [rbp + 0xfc0]
lea r8d, [rsi + 0x38]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140003adb
add dword [rbx + 8], r14d
lea rdi, [rbp - 0x80]
xor eax, eax
mov qword [rsp + 0x20], rsi
mov ecx, r15d
lea r9, [rbp + 0xfb8]
rep stosb byte [rdi], al
mov rcx, qword [rbx]
lea rdx, [rbp - 0x80]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140003adb
cmp word [rbp - 0x80], r12w
jne 0x140003adb
cmp byte [rbp - 0x7e], 0xc
jne 0x140003adb
cmp byte [rbp - 0x7d], 3
jne 0x140003adb
movzx eax, word [rbp - 0x78]
cmp eax, dword [rbp + 0xfb8]
jne 0x140003adb
mov eax, 0x100
cmp word [rbp - 0x68], ax
ja 0x140003adb
movzx edx, word [rbp - 0x68]
lea rcx, [rdx + 5]
and rcx, 0xfffffffffffffffc
sub rcx, rdx
sub rcx, 2
mov ecx, ecx
add rcx, rdx
cmp dword [rbp + rcx - 0x66], r14d
jne 0x140003adb
cmp word [rbp + rcx - 0x62], si
jne 0x140003adb
mov eax, r14d
jmp 0x140003add
xor eax, eax
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret