joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d480
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d6cb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x47d52c
mov qword [rsp + 0x88], rax
lea rbx, [0x004d5de0]
mov rcx, rax
lea rax, [0x00598200]
call fcn.00467840
test cl, cl
jne 0x47d511
mov rax, qword [rsp + 0x88]
call fcn.0047c3a0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x004d885c]
call fcn.0044bae0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.0047e860
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x47d54d
lea rdx, [0x004d5b20]
cmp rax, rdx
jne 0x47d53b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.0045c100
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x004c5680]
call fcn.0040a040
inc rdx
cmp rbx, rdx
jle 0x47d598
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47d54a
lea rax, [0x00598200]
lea rbx, [0x004d5de0]
lea rdi, [0x004d5b20]
call fcn.00468060
lea rdx, [0x004d5b20]
nop dword [rax]
cmp rax, rdx
jne 0x47d6bb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x004c16e0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004cb8e0]
nop
call fcn.0040cac0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x005ec170], 0
jne 0x47d5fa
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x47d609
mov rbx, rax
lea rax, [0x004cb8e0]
call fcn.004124e0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.0047be00
call fcn.0045c1c0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47d656
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x47d648
mov dword [rsi + 0x10], edx
cmp dword [0x005ec170], 0
jne 0x47d66e
mov qword [rsi + 0x30], rcx
jmp 0x47d677
lea rdi, [rsi + 0x30]
call fcn.00460620
lea rax, [0x00598200]
lea rbx, [0x004d5de0]
lea rdi, [0x004d5b20]
call fcn.00468060
lea rdx, [0x004d5b20]
cmp rax, rdx
jne 0x47d6ac
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x004c5680]
call fcn.0040a040
mov rbx, rdx
lea rcx, [0x004c5680]
call fcn.0040a040
nop
mov qword [rsp + 8], rax
call fcn.0045e2e0
mov rax, qword [rsp + 8]
jmp fcn.0047d480
Function at 0x1406b2cf8
Capabilities:
Encode data using xor

Disassembly:
sbb ch, ah
jle 0x1406b2ca4
movsd dword [rdi], dword [rsi]
sub edx, 0xfffffffe
rol dword [rbx + 0x6d], 0x8f
invalid
sub al, ah
invalid
jns 0x14072147f
insb byte [rdi], dx
xor ebx, dword [rax + 0x2f9f2240]
or ebx, ebx
xchg ebp, eax
jge 0x1406b2c8c
invalid
add r14d, 0x14d31c1f
setle r12b
add r12w, 0x356b
not r14
neg word [rsp + 0x28]
sub r14, 0x30874619
add r12w, r14w
movsx r12w, byte [rsp + 0x2e]
test byte [rsp + 0x2d], r14b
jl 0x140c16b9b
invalid
setbe byte [rsp + 0x28]
xor r12, qword [rsp + 0x28]
mov r14, qword [rsp + 0x50]
mov r12w, 0xec7
test r12b, r12b
setbe byte [rsp + 0x28]
call fcn.1406b8af1

Function at 0x140758a5c
Capabilities:
Encode data using xor

Disassembly:
cmova rbx, qword [rsp + 0x18]
jle 0x140c3629e
test dword [rax + 0x64dd599f], 0x552fb5d0
invalid
not bl
cmp bl, byte [rsp + 0x1b]
jbe 0x140c16c5f
neg word [rsp + 0x20]
not byte [rsp + 0x18]
mov rbx, qword [rsp + 0x50]
add qword [rsp + 0x20], 0x36f9099a
not word [rsp + 0x20]
not byte [rsp + 0x20]
sub dword [rsp + 0x20], 0x6a623f2f
and dword [rsp + 0x18], 0x666f52ef
neg dword [rsp + 0x18]
neg dword [rsp + 0x20]
call fcn.140c3f021
invalid

Function at 0x140c291f0
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 8], 0x5d0087
push rdi
sub byte [rsp + 0x48], r12b
not cl
movabs r13, 0x41765b353d4038f6
xor dword [rsp + 0x18], r11d
push rsi
push r9
push rbx
mov rcx, qword [rsp + 0x58]
movabs rsi, 0x544c3da817aa2c8f
lea r12, [r13*2 + 0x19e93a71]
cmp dword [rsp + 8], 0x26e12a5
mov rbx, r11
js 0x14071cd7c

Function at 0x140c7ef75
Capabilities:
Encode data using xor

Disassembly:
jae 0x140c4ba3d
jae 0x1406ae923
add byte [rcx], cl
add byte [rsi], al
add byte [0x14475c832], al
push rax
add esp, dword [rax + 2]
jo 0x14075ae38
xor byte [rbx + 0xe02e], ah
add byte [rax], al
add byte [rbx], ch
movabs dword [0x2b0000000000e02e], eax
mov esp, 0xf6a52fc6
jae 0x14075ae97
jge 0x14075aeb4
invalid
invalid
invalid
and dword [rsp + 0x28], 0x3e3b3532
movzx r9, r12w
jl 0x14075ae21
or word [rsp + 0x28], r12w
add r12b, 0x54
xor r12, r9
setae byte [rsp + 8]
call fcn.140ca1177
not cx
mov cl, 0x77
setae cl
mov ecx, 0x5d7c5659
push r11
push r15
movabs r15, 0x2ae90c3b69b85e18
movabs r11, 0xdce40fa17ad4221
and cx, 0xa9d
lea r11, [r11*2 + 0x1bcb0c27]
neg cl
push rsi
movabs rsi, 0x74f86226196011d5
call fcn.140739ece
out 0x4d, eax
sbb al, 0x53
invalid

Function at 0x140c94383
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or edx, 0x27494217
or edx, edx
seto dl
call fcn.140cb5c50
pop rbx
mov qword [rsp + 0x20], 0x2edf2a2c
setle r11b
movzx r14d, r13w
or r13w, word [rsp + 0x3c]
sub r14b, r14b
movsxd r14, r14d
xor r13d, 0x7de9498b
mov r11b, byte [rsp + 0x3d]
test byte [rsp + 7], r13b
lea r13, [r14*4 + 0x371e5ad1]
jbe 0x1406a0a22
add r13d, 0x6aed715b
not r11b
sub r13w, r14w
neg r14b
add qword [rsp + 0x10], 0xfffffffffffdd5da
and r11b, 0x1c
call fcn.140ca0667
and eax, 0xad17dbb7
in al, 0x6b
invalid
movzx rdx, bpl
neg edx
or ebp, 0x346761db
mov rbp, qword [rsp + 0x20]
jae 0x1406a09d5
Function at 0x140cb377d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.14070cb9d
call rax
mov r11, rax
cmp dil, spl
stc
jmp 0x140cb9543
call rax
mov r11, rax
test r12, r9
cmc
test rax, rax
jmp 0x140cb9566
cmp r12, 0x10236476
push r15
mov r15, r12
jge 0x140698cc5
or r12w, r12w
bswap r15d
mov r12b, 0x38
call fcn.140723675
retf
xor eax, eax
jmp 0x140cb94ba
jmp fcn.140cb96bd
test rax, rax
jmp 0x140cb954b
jne 0x140cb956c
lea rcx, [rsp + 0x40]
movsxd rax, r13d
cwde
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x140c79640
je 0x140cb94b3
cmp r11, rsi
jmp 0x140cb9574
jne 0x140cb9615
cmp byte [rsp + 0x180], dil
jmp 0x140cb9587
je 0x140cb95fb
lea rax, [rsp + 0x40]
movzx ecx, bp
rcl rdx, cl
or rdx, 0x3b8145f3
sub rbp, rax
bt dx, r9w
movzx rcx, r15w
movzx ecx, r13w
nop
lea rdx, [rsp + rdi + 0x40]
mov ecx, edi
bt ax, 0x8a
nop
rcr ax, 0xe4
mov eax, 0x7fd796c
rol eax, cl
add al, dil
xor al, byte [rdx + rbp]
jmp 0x140cb95d4
mov byte [rdx], al
jmp 0x140cb95db
je 0x140cb95f6
inc rdi
cmp rdi, 0x104
jmp 0x140cb95f0
jb 0x140cb95b0
lea rbp, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
movsx ax, r13b
bswap ax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp fcn.14073e2fb
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x140cb9622
jne 0x140cb9698
movzx edx, byte [rbx + 2]
cmp cx, r14w
cmc
jmp 0x140cb9636
add rbx, 2
cmp r11b, 2
test dil, 0xec
test dl, dl
je 0x140cb968d
nop
lea eax, [rdx - 0x30]
jmp 0x140cb9653
inc rbx
cmp r10b, bl
cmp dil, 0x83
cmp al, 9
jmp 0x140cb9664
ja 0x140cb968d
movsx eax, dl
sar dx, 0xb7
or dx, 0x2367
shld dx, bx, 0x8d
movzx edx, byte [rbx]
lea ecx, [rdi + rdi*4]
lea edi, [rax + rcx*2 - 0x30]
test dl, dl
jne 0x140cb964b
movsxd rdx, edi
rcr rcx, 0xf6
movzx rcx, bx
sub r8d, r8d
bswap ecx
mov rcx, r11
call fcn.140cb90d5
jmp fcn.140cb96bd
Function at 0x14003a095
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0xffffffffc002400c
jmp 0x14003a06a
movabs r9, 0x180000000
jmp 0x14003a2a4
jmp 0x14003a0aa
mov r8d, dword [rsp + 0x90]
not rsi
cmc
jmp 0x14003a35d
lea rdi, [r13*4]
sub bp, 0x1509
jmp 0x14003a2be
lea rsp, [rsp + 2]
mov qword [rsp + 0x58], r15
lea rsp, [rsp + 0x58]
pushfq
jmp 0x14003716a
push r9
mov r10w, 0x6137
mov r11d, 0xa5c7b94
lea r8, [rbp + rbp]
xchg rdx, rsi
jmp 0x14003a06c
stc
jmp 0x14003a10d
lea r15, [rdx + riz]
neg r9b
jbe 0x14003a15d
lea rbp, [rcx + riz - 0x2f]
jmp 0x14003a140
mov r13d, r11d
mov ebx, 0x1421774a
bsr r10d, r14d
jg 0x14003a0dd
stc
jmp 0x14003a10d
mov r14d, r8d
mov r9d, dword [rsp]
mov r12w, r9w
mov ebp, 0x1344980b
mov sil, 0xc
mov ebp, dword [rsp]
jmp 0x14003a0e0
xchg bl, r13b
sub rsp, 0x240
mov rcx, rsp
jmp 0x14003a0f8
xchg r10d, r12d
jmp 0x14003a165
jmp 0x14003a17e
push qword [rsp + 0x12]
xchg byte [rsp + 0x1d], r13b
xchg rdx, rbp
jmp 0x14003a198
lea rbp, [rcx + riz - 0x2f]
xchg r10d, r12d
neg r8d
mov r15d, 0x5c9c5715
sub rsp, 0x1c
jo 0x14003a145
neg r13w
jmp 0x14003a147
neg r13w
push qword [rsp + 0x12]
xchg byte [rsp + 0x1d], r13b
xchg rdx, rbp
jmp 0x14003a1c2
jmp 0x14003a131
lea rsp, [rsp + 4]
jmp 0x14003a1c7
bsr r12, r12
jns 0x14003a206
mov eax, r15d
mov r10d, 0xa6cb6f55
xor rsi, 0x590d72ac
bsr bp, r10w
jmp 0x14003a1ec
lea rsp, [rsp + 4]
lea rsp, [rsp + 0x20]
add r8d, 0x7b7a2a74
mov r9, qword [rsp]
mov rax, 0x5baddf8f
jmp 0x14003a19f
xor rsi, 0x590d72ac
bsr bp, r10w
sub r8d, 0x6d20241f
jmp 0x14003a227
mov eax, r15d
mov r10d, 0xa6cb6f55
jmp 0x14003a1e0
lea rsp, [rsp + 8]
sub r8d, 0x3f1263ec
mov dl, byte [rsp]
jmp 0x14003a263
mov r13b, r12b
mov rdx, qword [rsp]
not edx
pushfq
bswap r13d
jmp 0x14003a211
xchg r10b, r15b
bswap rsi
jmp 0x14003a287
mov r9d, 0x18ab778
xchg r10b, r15b
bswap rsi
jmp 0x14003a287
mov dx, di
cmc
ja 0x14003a24c
mov r9d, 0x18ab778
jmp 0x14003a236
mov r11, r15
mov sil, 0x8f
dec rsi
xchg bpl, r13b
jmp 0x140037180
ror r8d, 0
jb 0x14003a271
mov r11, r15
jmp 0x14003a296
mov sil, 0x8f
dec rsi
xchg bpl, r13b
jmp 0x140037180
xchg dl, r11b
jmp 0x14003a305
lea rdi, [rsp]
rdtsc
mov r13w, word [rsp]
rcl bp, 0xe
jp 0x14003a196
xchg bl, r13b
jmp 0x14003a134
sub rsp, 0x13
jb 0x14003a33b
lea r12, [0x4678ca2e]
lea rbx, [rbx*8]
lea rsp, [rsp + 3]
jmp 0x14003a39b
setp dl
lea rax, [rax*8]
lea rsi, [0x5be0a96b]
add r8, r9
lea rdx, [rdi + riz + 0x4a91]
jmp 0x14003a2db
lea rsp, [rsp + 3]
jmp 0x14003a39b
lea r12, [0x4678ca2e]
lea rbx, [rbx*8]
jmp 0x14003a325
jg 0x14003a07e
lea rdi, [r13*4]
sub bp, 0x1509
jmp 0x14003a2be
add r8, qword [rdi + riz]
rdtsc
mov si, 0x9704
xchg esi, edx
mov r11, qword [rsp]
jmp 0x14003a375

Function at 0x14003a3b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov rdx, 0x5da7f3ea
dec r15
xchg r11b, r10b
call fcn.14003a5b8
ror byte [rbp - 0x24], cl
sete r9b
mov dx, ax
bswap r13d
bswap r10
jmp 0x14003a43a
Function at 0x14003ab4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 8]
jmp 0x14003aa89
add bpl, 0xf8
mov r15w, 0x218a
stc
jne 0x14003aaf1
rdtsc
bswap rdx
bswap r13
jmp 0x14003aada
mov r15d, 0x651e2859
bswap eax
mov r15, 0x27e68f83
jmp 0x14003ab1b
bswap rdx
bswap r13
add r14b, bpl
jmp 0x14003aabe
rdtsc
jmp 0x14003aad4
neg r11d
jmp 0x14003ab2b
neg r11d
cmp eax, edx
mov r11, 0xffffffff8cb31f5a
btc esi, r12d
cmc
jmp 0x14003ab7d
mov r10w, 0x3277
dec r8
btr r10, r13
jg 0x14003aaf5
jle 0x14003aafe
cmp eax, edx
mov r11, 0xffffffff8cb31f5a
btc esi, r12d
jmp 0x14003ab7c
mov byte [rsp + 1], al
bsr rdx, r8
jl 0x14003aa7e
jge 0x14003aa7e
xchg rbx, r9
lea rsp, [rsp + 7]
cmp bx, 0x6718
lea r9, [rax + rsi]
inc r13w
jmp 0x14003b9d1
cmc
rol r10b, cl
sub rsp, 0xe
jns 0x14003ab60
js 0x14003ab90
or al, 0x9a
or byte [rdi - 0x66], ch
and al, 0x7b
push rdx
xchg rbx, r9
lea rsp, [rsp + 7]
cmp bx, 0x6718
jmp 0x14003c664
lea rsp, [rsp + 7]
neg r12b
mov ebp, 0x8041ee97
call fcn.14003b193
lea r9, [rax + rsi]
inc r13w
jmp 0x14003b9d1

Function at 0x14003ac56
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg r15, r9
call fcn.14003abe3
rdtsc
jmp 0x14003aca1
movabs r9, 0x134606876
jmp 0x14003af35
mov r9d, 0x21c76815
rol r12b, 0
jge 0x14003acc7
jl 0x14003acd1
shr r9b, 3
mov dl, r10b
mov r15w, 0x665a
call fcn.14003ad31
movabs dword [reloc.IPHLPAPI.DLL_GetInterfaceInfo], eax
xor al, 0x24
mov rsi, qword [rsp]
jmp 0x14003acaf
mov rsi, qword [rsp]
shr r9b, 3
mov dl, r10b
mov r15w, 0x665a
jmp 0x14003ad73
dec r10d
jmp 0x14003adc9
mov esi, dword [rsp]
jmp 0x14003ad81
dec bl
jmp 0x14003adae
movabs r13, 0x14002400c
jmp 0x14003afc3
neg r12b
rdtsc
xchg r10, r9
setnp r9b
ror sil, cl
jmp 0x14003add7
mov r11, qword [rsp]
clc
jno 0x14003ad78
mov esi, dword [rsp]
dec bl
jmp 0x14003adae
jb 0x14003aded
sub rsp, 0xa
setns bpl
jmp 0x14003af99
sub rsp, 0xa
setns bpl
pop r10
lea rsp, [rsp + 2]
jmp 0x14003aeca
xchg r11w, dx
mov r13d, 0xbe345f57
mov r10, r12
mov rdx, qword [rsp]
neg rdx
jmp 0x14003aee7
mov ebp, 0x2089246c
jmp 0x14003ae59
dec r12b
inc r9w
jp 0x14003ae8f
mov ebp, 0x2089246c
xchg r11w, dx
mov r13d, 0xbe345f57
call fcn.14003ae33
jb 0x14003aefd
xchg ebx, r9d
neg rbx
jmp 0x14003af03
xchg ebx, r9d
neg rbx
jmp 0x14003af57
shr r13d, cl
jmp 0x14003af2d
mov rbx, r8
jmp 0x14003ac62
add r10, r9
bsf r11, rsi
jno 0x14003af6e
xchg r13w, dx
mov esi, 0x4efe01b1
inc r15w
jmp 0x14003af73
shl r10, 2
xchg rdx, rbp
shr bl, 4
jnp 0x14003af05
shr r13d, cl
mov rbx, r8
jmp 0x14003ac62
jmp 0x14003aff9
mov r10d, dword [r10 + riz + reloc.IPHLPAPI.DLL_GetInterfaceInfo]
mov r11d, dword [rsp]
mov r11d, r10d
bswap r13d
mov r11w, word [rsp]
jmp 0x14003ad85
pop r10
lea rsp, [rsp + 2]
jmp 0x14003aeca
call fcn.14003afa5
mov rsp, rcx
jmp 0x14003b0f5
xchg r13w, dx
mov esi, 0x4efe01b1
inc r15w
jmp 0x14003af73
push r10
ret
Function at 0x14003b193
Capabilities:
Execute anti-debugging instructions

Disassembly:
jno 0x14003ac8f
lea rsi, [r14 + rbp]
mov r11, qword [rsp]
call fcn.14003ac56
loope 0x14003ac0f
shr bh, cl
and al, 0x10
lea rsi, [r14 + rbp]
mov r11, qword [rsp]
mov r10d, dword [rsp]
lea rax, [r9 + rbp]
rdtsc
lea rsp, [rsp + 8]
xor r12b, 0x11
xchg rsi, rax
setp r13b
shr r15, 0x28
jmp 0x14003abb9
mov byte [rsp + 1], al
mov byte [rsp + 2], cl
push di
jp 0x14003b166
jnp 0x14003b14c
add eax, 0x83701181
invalid
mov word [rsp + 3], r15w
lea rsp, [rsp + 7]
jmp 0x14003b17f
pop word [rsp]
push word [rsp + 5]
lea rsp, [rsp + 3]
jmp 0x14003b136
pop word [rsp]
push word [rsp + 5]
lea rsp, [rsp + 3]
mov word [rsp + 3], r15w
lea rsp, [rsp + 7]
add ecx, dword [rax - 0x73]
and al, 7
mov qword [rsp + 8], rbx
call fcn.14003b289
cmc
jge 0x14003b179
je fcn.14003b115
cmp cl, ah
pop rdi
cmpsb byte [rsi], byte [rdi]
ror dword [rax - 0x7d], 1
sub rsp, 3
jae 0x14003b131
bsf rsi, rdi
mov rdx, rsp
lea rsp, [rsp + 3]
jmp 0x14003ace9
Function at 0x140003274
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400032ae
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400032b3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400032fc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400053e0]
cmp byte [rcx + rax], 0
je 0x1400032fc
dec r8
sub rdx, 1
jne 0x1400032e2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140003ebc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003f06
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003f06
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f06
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003f06
cmp dword [rcx + 0x84], 0xe
jbe 0x140003f06
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003f08
xor al, al
add rsp, 0x28
ret
Function at 0x14012d3c8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14012d3e8
xor eax, eax
jmp 0x14012d4ce
cmp qword [rcx + 0x68], 0
je 0x14012d3f9
call fcn.14012dbec
jmp 0x14012d4ce
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14012d410
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14012d412
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14012d444
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140349170
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14012d4c8
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14012d47b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14012d4a4
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14031d484
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x14012d4c8
cmp rdi, rbx
ja 0x14012d482
test rdi, rdi
je 0x14012d4c8
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.14031d484
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140136c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
or ebx, 0xffffffff
lea r15, [0x140408f80]
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x140
jb 0x140136d6b
lea rsi, [rdx - 0x100]
shr rsi, 6
imul rax, rsi, 0xffffffffffffffc0
add rdi, rax
mov ebp, 4
xor ebx, dword [r14]
mov r9d, dword [r14 + 4]
mov r10d, dword [r14 + 8]
mov r11d, dword [r14 + 0xc]
add r14, 0x10
mov r8d, ebx
mov eax, ebx
shr rax, 0x10
movzx edx, al
mov eax, ebx
shr rax, 8
movzx ecx, al
mov eax, r9d
mov ebx, dword [r15 + rdx*4 + 0x3400]
shr rax, 0x10
xor ebx, dword [r15 + rcx*4 + 0x3800]
movzx ecx, al
mov eax, r9d
shr rax, 8
xor ebx, dword [r15 + rcx*4 + 0x2400]
movzx ecx, al
mov eax, r10d
shr rax, 0x10
xor ebx, dword [r15 + rcx*4 + 0x2800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor ebx, dword [r15 + rcx*4 + 0x1400]
movzx ecx, al
mov eax, r11d
shr rax, 0x10
xor ebx, dword [r15 + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r11d
shr rax, 8
xor ebx, dword [r15 + rcx*4 + 0x400]
movzx ecx, al
mov eax, r8d
shr rax, 0x18
xor ebx, dword [r15 + rcx*4 + 0x800]
xor ebx, dword [r15 + rax*4 + 0x3000]
mov eax, r9d
shr rax, 0x18
xor ebx, dword [r15 + rax*4 + 0x2000]
mov eax, r10d
shr rax, 0x18
xor ebx, dword [r15 + rax*4 + 0x1000]
mov eax, r11d
shr rax, 0x18
xor ebx, dword [r15 + rax*4]
movzx eax, r8b
xor ebx, dword [r15 + rax*4 + 0x3c00]
movzx eax, r9b
xor ebx, dword [r15 + rax*4 + 0x2c00]
movzx eax, r10b
xor ebx, dword [r15 + rax*4 + 0x1c00]
movzx eax, r11b
xor ebx, dword [r15 + rax*4 + 0xc00]
sub rbp, 1
jne 0x140136c4b
sub rsi, 1
jne 0x140136c46
test rdi, rdi
je 0x140136d8a
movzx eax, byte [r14]
inc r14
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r15 + rcx*4]
sub rdi, 1
jne 0x140136d70
mov rbp, qword [rsp + 0x20]
not ebx
mov rsi, qword [rsp + 0x28]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140136f58
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140432200]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x70], WSAGetLastError
xor esi, esi
mov qword [rsp + 0x78], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x14040d950]
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov dword [rbp - 0x50], esi
mov qword [rbp - 0x48], rsi
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r8d, [rsi + 7]
lea rdx, [0x14040cf80]
lea rcx, [rsp + 0x50]
call fcn.14012ffe8
nop
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 8]
call fcn.140136db0
nop
lea rcx, [rsp + 0x50]
call fcn.14012eb4c
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rdx, qword [rbp - 8]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14013704f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140137059
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 8]
call fcn.14012eb4c
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140151860
mov rbx, qword [rsp + 0x150]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
Function at 0x140137148
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140432200]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov edx, 0x2a
mov rbx, rcx
call fcn.1403159fc
xor edi, edi
mov rcx, rbx
test rax, rax
je 0x1401372e8
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401372f3
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1401371c1
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1401302c4
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14013727a
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140137235
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140137230
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140137338
call fcn.140151880
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1401371a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140151860
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 5
je 0x1401372a3
cmp edi, 0x20
je 0x14013729c
mov ebx, 4
jmp 0x1401372a8
mov ebx, 2
jmp 0x1401372a8
mov ebx, 3
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401372e1
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401372dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140137338
call fcn.140151880
mov eax, ebx
jmp 0x140137256
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401372fd
mov eax, 1
jmp 0x140137256
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140137254
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 5
je 0x14013732e
mov eax, 2
cmp ecx, 0x20
lea ebx, [rax + 2]
cmovne eax, ebx
jmp 0x140137256
mov eax, 3
jmp 0x140137256
call fcn.14031dc94
int3