joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001feb4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140110180]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.1400093e0
mov rcx, qword [0x140110738]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140110740]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140110748]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140110740], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.1400093e0
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001ffdd
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x140110738]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140110738]
jne 0x140020032
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140020032
mov rcx, qword [0x140110738]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140020032
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140020040
or eax, 0xffffffff
jmp 0x140020045
call fcn.14000941c
cmp dword [0x14004c138], eax
je 0x140020058
mov dword [0x14004c138], eax
call fcn.140020080
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003de60
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14003309c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x1400330ef
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400330b4
jmp 0x1400330fc
cmp dword [rcx], 0x4e0
jb 0x1400330fc
call fcn.1400394f0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x14003326c
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
movss xmm2, dword [0x1401107d4]
lea rax, [0x140110c58]
movss xmm1, dword [0x1401107d0]
lea r9, [0x140110c50]
movss xmm0, dword [0x14010e3f0]
mov qword [rsp + 0x28], rax
lea rax, [0x140110c54]
mov qword [rsp + 0x20], rax
call fcn.1400072a8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x140110c5c]
sub eax, ecx
cmp eax, 1
jb 0x1400332fd
cmp dword [0x140110c60], ecx
je 0x1400332f1
movss xmm0, dword [0x140110c50]
movss xmm1, dword [0x14010e414]
mulss xmm1, dword [0x14004599c]
mov dword [0x140110c60], ecx
addss xmm0, xmm1
movss dword [0x140110c50], xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140110c5c], eax
movss xmm3, dword [0x140110c50]
xorps xmm0, xmm0
comiss xmm0, xmm3
jbe 0x14003331d
addss xmm3, dword [0x140040b24]
movss dword [0x140110c50], xmm3
movss xmm2, dword [0x140110c58]
lea rax, [0x1401107d4]
movss xmm1, dword [0x140110c54]
lea r9, [0x14010e3f0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmm3
lea rax, [0x1401107d0]
mov qword [rsp + 0x20], rax
call fcn.14000715c
add rsp, 0x38
ret
Function at 0x1400384a4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140110180]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
jmp 0x140038509
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003853d
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400384ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x140110be8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14003de60
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x140110be8], eax
jmp 0x14003851c

Function at 0x1400386d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140110180]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, r8d
mov rsi, rdx
xor eax, eax
cmp ecx, 0x7b
ja 0x140038710
movsxd rax, ecx
lea rcx, [0x14010e8a0]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
and qword [rbp - 0x18], 0
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
test rax, rax
jne 0x140038754
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x140045378]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], 0
jmp 0x140038764
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400398bc
mov rdx, qword [rbp - 0x10]
cmp edi, 1
jne 0x1400387b4
lea eax, [rdi + 0xc]
cmp rdx, rax
jb 0x14003879a
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov r8d, eax
lea rdx, str.Press_the_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x1400387b0
lea r9, str.Press_the_key
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14003244c
mov rdx, qword [rbp - 0x10]
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp rdx, 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140025cac
test al, al
je 0x1400387fb
test edi, edi
jne 0x1400387fb
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140038839
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140038834
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003da60
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003de60
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400394f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140039507
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140039552
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x14003996c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [0x140045af0]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov rdx, rcx
movd xmm0, dword [rsp]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmmword [0x140045ad0]
andps xmm1, xmmword [0x140045ae0]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
psubb xmm1, xmm0
movd xmm0, dword [rdx]
xorps xmm1, xmm0
movd dword [rdx], xmm1
lea rdx, [rdx + 4]
cmp eax, 0x20
jb 0x140039982
mov byte [rcx + 0x20], 0
mov rax, rcx
add rsp, 0x18
ret
Function at 0x14003c878
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea r8, [0x1400392c8]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x98], rdi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rsi, str.Bluestacks_5
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
lea rax, [0x1400393a4]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 3
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14003c932
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Bluestacks
call fcn.140031f94
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
mov r9d, 0x80000000
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x140110a98], rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140110a98]
lea rdx, [0x1400451c0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x140110a98]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140110a98]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14003e688
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e6d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e6d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e6d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e6d2
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e6d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003e6d4
xor al, al
add rsp, 0x28
ret
Function at 0x14001124e
Capabilities:
Terminate process

Disassembly:
jmp 0x140013c30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014fa0
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014fb3
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014fdd
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ff1
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015003
xor al, al
jmp 0x140015021
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001501f
xor al, al
jmp 0x140015021
mov al, 1
add rsp, 0x38
ret
Function at 0x140012e50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011424
movzx eax, al
test eax, eax
jne 0x140012e70
mov ecx, 7
call fcn.140011398
nop
mov byte [rsp + 0x20], 0
call fcn.1400113ac
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x140012e94
mov ecx, 7
call fcn.140011398
nop
jmp 0x140012eec
cmp dword [0x14001f868], 0
jne 0x140012ee7
mov dword [0x14001f868], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111f9
test eax, eax
je 0x140012ec8
mov eax, 0xff
jmp 0x140012ff1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.1400113a2
mov dword [0x14001f868], 2
jmp 0x140012eec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011384
call fcn.14001130c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012f49
mov rcx, qword [rsp + 0x30]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x140012f49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011343
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012f7d
mov rcx, qword [rsp + 0x38]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x140012f7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113e3
nop
call fcn.1400130a0
mov dword [rsp + 0x28], eax
call fcn.1400112e9
movzx eax, al
test eax, eax
jne 0x140012f9c
mov ecx, dword [rsp + 0x28]
call fcn.140011064
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012fab
call fcn.1400113ed
nop
xor edx, edx
mov cl, 1
call fcn.140011186
mov eax, dword [rsp + 0x28]
jmp 0x140012ff1
add rsp, 0x68
ret
Function at 0x14001113b
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140011e70
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400230a5]
call fcn.1400113b6
nop
movzx eax, word [rbp + 0x100]
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001134d
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011226
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112b7
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e70
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e83
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ead
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ec1
xor al, al
jmp 0x140014ef1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ed3
xor al, al
jmp 0x140014ef1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014eef
xor al, al
jmp 0x140014ef1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011370
Capabilities:
Execute command

Disassembly:
jmp 0x1400119a0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a5]
call fcn.1400113b6
nop
lea rcx, [0x14001ae7c]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov edx, 5
mov ecx, 0x1e
call fcn.14001113b
nop
mov edx, dword [rbp + 0x128]
lea rcx, [0x14001ae80]
call fcn.1400111b8
nop
mov dword [rbp + 4], 0
jmp 0x140011a06
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xa
jge 0x140011a66
mov eax, dword [rbp + 4]
add eax, 6
mov edx, eax
mov ecx, 0x1e
call fcn.14001113b
nop
mov dword [rbp + 0x24], 0
jmp 0x140011a30
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xa
jge 0x140011a64
movsxd rax, dword [rbp + 4]
imul rax, rax, 0xa
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x24]
movsx eax, byte [rax + rcx]
mov edx, eax
lea rcx, [0x14001ae94]
call fcn.1400111b8
nop
jmp 0x140011a28
jmp 0x1400119fe
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140012d30
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113de
movzx eax, al
test eax, eax
jne 0x140012d50
mov ecx, 7
call fcn.140011357
nop
mov byte [rsp + 0x20], 0
call fcn.14001136b
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x140012d74
mov ecx, 7
call fcn.140011357
nop
jmp 0x140012dcc
cmp dword [0x14001e868], 0
jne 0x140012dc7
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111bd
test eax, eax
je 0x140012da8
mov eax, 0xff
jmp 0x140012ed1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011361
mov dword [0x14001e868], 2
jmp 0x140012dcc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011343
call fcn.1400112da
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012e29
mov rcx, qword [rsp + 0x30]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x140012e29
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.140011311
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012e5d
mov rcx, qword [rsp + 0x38]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x140012e5d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001139d
nop
call fcn.140012f80
mov dword [rsp + 0x28], eax
call fcn.1400112b7
movzx eax, al
test eax, eax
jne 0x140012e7c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012e8b
call fcn.1400113a7
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140012ed1
add rsp, 0x68
ret
Function at 0x140005840
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000589d
lea rbx, [0x14010b310]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140005884
cmp r10, 2
jb 0x140005884
cmp byte [r9], r8b
jne 0x140005884
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140005860
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400058df
lea rbx, [0x14010b310]
cmp r8b, 0x23
jne 0x1400058c3
cmp byte [r9], r8b
jne 0x1400058c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400058b0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140005a20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140005a3a
mov qword [r8], 0
lea rdx, [0x14010ae60]
call fcn.1400058f0
mov rbx, rax
test rax, rax
jne 0x140005a5a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140005b33
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005b33
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140005b33
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005b33
cmp rdi, 0xffffffffffffffff
je 0x140005b33
mov rax, qword [0x140360f30]
test rax, rax
je 0x140005ad0
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140005b33
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140005b20
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140360f30]
test rax, rax
je 0x140005b15
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140005b3c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140005b2e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140005b3e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret