joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14085e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14085e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14085e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14085e06f
add dl, dl
jne 0x14085e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14085e0f6
xor eax, eax
add dl, dl
jne 0x14085e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14085e1ad
add dl, dl
jne 0x14085e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14085e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14085e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14085e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14085e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14085e07e
mov eax, 1
add dl, dl
jne 0x14085e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14085e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14085e0fb
sub eax, ebx
mov ebx, 1
jne 0x14085e14c
mov ecx, 1
add dl, dl
jne 0x14085e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14085e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14085e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14085e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14085e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14085e15d
cmp eax, 0x7d00
jae 0x14085e19b
cmp eax, 0x500
jb 0x14085e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085e07e
cmp eax, 0x7f
ja 0x14085e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14085e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14085e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x1a9376c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1a93776
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1a9379f
pop rbp
sub rbp, 0x33
sub rbp, 0x169376c
sub rsp, 0x20
jmp 0x1a937be
mov rax, 0x169376c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff5926797
xor byte [rax], dl
inc rax
dec rcx
jne 0x1a937dd
jmp 0x1a937f4
fistp word [rsi]
jle 0x1a93814
invalid
xchg edi, eax
fbld tbyte [rax + 0x75]
fist word [rsi - 0x64e9e3aa]
xchg edi, eax
xchg edi, eax
xchg edi, eax
fist word [rsi - 0x20383881]
invalid
Function at 0x1407005f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140700602
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14070062b
pop rbp
sub rbp, 0x33
sub rbp, 0x7005f8
sub rsp, 0x20
jmp 0x14070064a
mov rax, 0x7005f8
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffffb4f4baf2
xor byte [rax], dl
inc rax
dec rcx
jne 0x140700669
jmp 0x140700680
mov edx, 0x7b791b7b
invalid

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002248]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002238]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140044ba0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140044bad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140044bbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140044ba5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140044bd5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140044bc2
sub eax, 3
jb 0x140044bef
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140044c26
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140044c16
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140044c14
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140044c03
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140044b62
jmp 0x140044bad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140044c72
cmp rsi, rcx
jae 0x140044c7a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140044c59
cmp al, 0x8f
ja 0x140044c59
cmp byte [rsi - 2], 0xf
je 0x140044c5f
sub al, 0xe8
cmp al, 1
ja 0x140044c43
cmp rsi, rcx
jae 0x140044c7a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140044c49
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140044c7a
lodsb al, byte [rsi]
jmp 0x140044c59
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x42000]
mov eax, dword [rdi]
or eax, eax
je 0x140044ce3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5e3dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140044c87
jns 0x140044cbc
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140044cc6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140044cdd
mov qword [rbx], rax
add rbx, 8
jmp 0x140044ca7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140044d3b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x14000191c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001966
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001966
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001966
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001966
cmp dword [rcx + 0x84], 0xe
jbe 0x140001966
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001968
xor al, al
add rsp, 0x28
ret
Function at 0x14004a890
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004a89d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004a8ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14004a895
lea eax, [rcx + 1]
jmp 0x14004a8bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004a8ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14004a8b4
sub eax, 3
jb 0x14004a8ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14004a93d
sar eax, 1
movsxd rbp, eax
jb 0x14004a924
jmp 0x14004a8fc
add ebx, ebx
jne 0x14004a8fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004a924
inc ecx
add ebx, ebx
jne 0x14004a90a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004a924
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004a91d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004a90c
add ecx, 2
jmp 0x14004a929
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14004a852
jmp 0x14004a89d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29c00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14004a989
cmp rsi, rcx
jae 0x14004a991
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14004a970
cmp al, 0x8f
ja 0x14004a970
cmp byte [rsi - 2], 0xf
je 0x14004a976
sub al, 0xe8
cmp al, 1
ja 0x14004a95a
cmp rsi, rcx
jae 0x14004a991
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14004a960
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14004a991
lodsb al, byte [rsi]
jmp 0x14004a970
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x48000]
mov eax, dword [rdi]
or eax, eax
je 0x14004a9fa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4b6c0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14004a99e
jns 0x14004a9d3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14004a9dd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004a9f4
mov qword [rbx], rax
add rbx, 8
jmp 0x14004a9be
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14004aa34
cmp al, 0xef
ja 0x14004aa26
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14004aa06
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14004aa15
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14004aa88
sub rsp, 0xffffffffffffff80
jmp 0x14000c200
Function at 0x140066020
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140065e00
nop
lea rax, vtable.Poco::MD5Engine.0
mov qword [rbx], rax
lea rcx, [rbx + 0x60]
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea edx, [rdi + 0x10]
call fcn.140065e50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 8], xmm0
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x18], rdi
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400660b0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
lea rax, vtable.Poco::MD5Engine.0
mov qword [rcx], rax
xor edi, edi
movups xmmword [rcx + 0x20], xmm0
mov rbx, rcx
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rdi
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x14006613e
mov rdx, qword [rbx + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14006612d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140066150
mov rcx, r8
call fcn.140039d90
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140065e10
call fcn.14004979c
int3

Function at 0x140066160
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
lea rax, vtable.Poco::MD5Engine.0
mov qword [rcx], rax
xor esi, esi
movups xmmword [rcx + 0x20], xmm0
mov rbx, rcx
mov edi, edx
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rsi
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x1400661f5
mov rdx, qword [rbx + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400661e4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140066223
mov rcx, r8
call fcn.140039d90
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x70], rsi
mov rcx, rbx
call fcn.140065e10
test dil, 1
je 0x140066210
mov edx, 0x78
mov rcx, rbx
call fcn.140039d90
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14004979c
int3
Function at 0x140066390
Capabilities:
Hash data with md5

Disassembly:
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x140067da0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140065e00
nop
lea rax, vtable.Poco::MD4Engine.0
mov qword [rbx], rax
lea rcx, [rbx + 0x60]
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea edx, [rdi + 0x10]
call fcn.140065e50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 8], xmm0
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x18], rdi
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140067e30
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
lea rax, vtable.Poco::MD4Engine.0
mov qword [rcx], rax
xor edi, edi
movups xmmword [rcx + 0x20], xmm0
mov rbx, rcx
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rdi
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x140067ebe
mov rdx, qword [rbx + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140067ead
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140067ed0
mov rcx, r8
call fcn.140039d90
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140065e10
call fcn.14004979c
int3
Function at 0x140067ee0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
lea rax, vtable.Poco::MD4Engine.0
mov qword [rcx], rax
xor esi, esi
movups xmmword [rcx + 0x20], xmm0
mov rbx, rcx
mov edi, edx
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rsi
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x140067f75
mov rdx, qword [rbx + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140067f64
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140067fa3
mov rcx, r8
call fcn.140039d90
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x70], rsi
mov rcx, rbx
call fcn.140065e10
test dil, 1
je 0x140067f90
mov edx, 0x78
mov rcx, rbx
call fcn.140039d90
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.14004979c
int3

Function at 0x14006a1d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x50], 0
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov rcx, qword [rsp + 0x50]
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140003ad0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003b04
cmp word [rcx], 0x5a4d
jne 0x140003b04
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003b04
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b04
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a10
test eax, eax
jne 0x140003b20
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a80
test rax, rax
je 0x140003b15
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400042d2
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400041d0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004170
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004624
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140469358]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140469354]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004672
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000466a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004759
inc ebx
add rax, 0x28
jmp 0x14000464a
mov rcx, r12
call fcn.140004e51
mov rbp, rax
test rax, rax
jne 0x140004691
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400045c0
movsxd rbx, ebx
mov rax, qword [0x140469358]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004eff
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140469358]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400046f3
mov rax, qword [0x140469358]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400045c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004753
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004753
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140469358]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004753
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400045c0
inc dword [0x140469354]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004b80
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1404693c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1404693a0]
test rbx, rbx
je 0x140004bcc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004bc6
test eax, eax
jne 0x140004bc6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004b9e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004d80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004da3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004da3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004da4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004dde
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004dd5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004de0
inc r8d
add rax, 0x28
jmp 0x140004dbc
xor eax, eax
ret

Function at 0x140004e51
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140465450]
mov r8, rcx
mov rcx, r9
call fcn.140004d80
test eax, eax
je 0x140004e7d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004da4
xor eax, eax
add rsp, 0x28
ret