joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423840
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [fcn.0042f220]
mov rbx, rcx
mov ecx, 1
call rdi
mov r12, qword [rbx]
mov rbp, qword [rbx + 8]
lea r8, [0x0043e838]
mov rsi, rax
test r12, r12
je 0x423877
lea r8, [rbp + 8]
lea rdx, [0x0043e820]
mov rcx, rsi
lea r13, [0x0043e820]
call fcn.004234e7
mov ebx, eax
movsxd rax, ebx
cmp rax, r12
jge 0x4238c8
cmp byte [rbp + rax + 8], 0
jne 0x4238b0
xor ecx, ecx
mov rdx, rsi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x4238c8
inc ebx
jmp 0x42388f
lea r8, [rbp + rax + 8]
mov rdx, r13
mov rcx, rsi
call fcn.004234e7
test eax, eax
jle 0x4238c8
add ebx, eax
jmp 0x42388f
mov rax, qword [0x0043fa60]
cmp byte [rax], 0
jne 0x423910
mov ecx, 1
call rdi
mov r8d, 1
mov edx, 1
lea rcx, [0x0043e839]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rdi
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.0042ec30
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x423ad9
Capabilities:
Hash data using murmur3

Disassembly:
mov r8, qword [rdx]
mov r9d, ecx
mov rcx, qword [rdx + 8]
cmp r9b, 1
je 0x423b0b
cmp r9b, 2
je 0x423b55
xor eax, eax
test r9b, r9b
jne 0x423bc1
test rcx, rcx
je 0x423b03
add rcx, 8
mov rdx, r8
jmp fcn.0040acdf
mov rax, qword [0x0043fa60]
dec r8
xor r9d, r9d
mov r10b, byte [rax]
xor eax, eax
cmp r8, r9
jl 0x423b70
mov dl, byte [rcx + r9 + 8]
lea r11d, [rdx - 0x41]
cmp r11b, 0x19
ja 0x423b34
add edx, 0x20
movzx edx, dl
add rax, rdx
imul rax, rax, 0x401
mov rdx, rax
shr rdx, 6
xor rax, rdx
test r10b, r10b
jne 0x423bbf
inc r9
jmp 0x423b1d
mov rax, qword [0x0043fa60]
mov r9d, 1
mov r10b, byte [rax]
xor eax, eax
lea rdx, [r9 - 1]
cmp r8, rdx
jg 0x423b87
lea rax, [rax + rax*8]
mov rdx, rax
shr rdx, 0xb
xor rax, rdx
imul rax, rax, 0x8001
jmp 0x423bc1
mov dl, byte [rcx + r9 + 7]
cmp dl, 0x5f
jne 0x423b96
inc r9
jmp 0x423b67
lea r11d, [rdx - 0x41]
cmp r11b, 0x19
ja 0x423ba3
add edx, 0x20
movzx edx, dl
add rax, rdx
imul rax, rax, 0x401
mov rdx, rax
shr rdx, 6
xor rax, rdx
test r10b, r10b
je 0x423b91
xor eax, eax
ret
Function at 0x425bd0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0042f220
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.0042f220
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x425c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x004484c4]
mov r12, rcx
test ebx, ebx
jle 0x425d70
mov rax, qword [0x004484c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x425c8c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x425d13
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x425c70
mov rcx, r12
call fcn.004265f0
mov rsi, rax
test rax, rax
je 0x425d92
mov rax, qword [0x004484c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.00426720
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004484c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x425d77
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x425d0c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x425d20
add dword [0x004484c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x004484c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x425d0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00425bd0
nop dword [rax]
xor ebx, ebx
jmp 0x425c97
mov rax, qword [0x004484c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00425bd0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00425bd0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x426260
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00448520]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00448500]
test rbx, rbx
je 0x4262b4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4262ab
test r12, r12
je 0x4262ab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x426290
lea rcx, [0x00448520]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4265f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x0043f7b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x426610
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x426618
ret
cmp word [r8 + 0x18], 0x20b
jne 0x426610
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x426665
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x42665c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x426610
add rax, 0x28
cmp rax, r9
jne 0x426648
xor eax, eax
ret

Function at 0x426670
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x0043f7b0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x426690
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x426698
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x426690
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x426720
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x0043f7b0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x426740
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x426748
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140002a10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002a6d
lea rbx, [0x14006ee70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002a54
cmp r10, 2
jb 0x140002a54
cmp byte [r9], r8b
jne 0x140002a54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002a30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002aaf
lea rbx, [0x14006ee70]
cmp r8b, 0x23
jne 0x140002a93
cmp byte [r9], r8b
jne 0x140002a93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002a80
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002bf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002c0a
mov qword [r8], 0
lea rdx, [0x14006eafc]
call fcn.140002ac0
mov rbx, rax
test rax, rax
jne 0x140002c2a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002d01
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d01
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002d01
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d01
cmp rdi, 0xffffffffffffffff
je 0x140002d01
mov rax, qword [0x140093e10]
test rax, rax
je 0x140002c9e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002d01
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002cee
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140093e10]
test rax, rax
je 0x140002ce3
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002d0a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002cfc
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002d0c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005180
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14006ee70]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x140093e10]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3edc], ebx
jne 0x140005216
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.1400173a0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140011180
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140093e10]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x1400111e1
cmp byte [rbx + 0x424e], 0
jne 0x1400111e1
movsx r9d, word [rbx + 0x532e]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002990
test dil, 1
je 0x140011308
jmp 0x14001126a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x532e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400782e4]
mulss xmm1, dword [0x1400782d8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x14007814c]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.140002990
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400112c0
lea r11, [0x14006ee70]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400112a3
cmp byte [r8], r9b
jne 0x1400112a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140011290
not ecx
call fcn.14000a1a0
test rax, rax
je 0x140011308
cmp byte [rax + 0x96], 0
je 0x140011308
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x532e]
mov edx, 0x10
movsx r9d, word [rbx + 0x532e]
call fcn.140002990
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c8b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d0c0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140016000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400160a7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001605a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018010
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003110
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140093e08]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400160af
mov rcx, rbx
call fcn.140003110
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140016620
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140093e10]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140016683
mov qword [rsp], rbx
lea rbx, [0x14006ee70]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016663
cmp byte [r8], r9b
jne 0x140016663
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140016650
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400166b7
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400166be
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1400166a4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140040e70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.14004f770
sub rsp, rax
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r9d, 1
mov dword [rsp + 0x24], eax
mov r10d, 0x270
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x140040ec6
mov edx, dword [rbx]
mov ebp, 0x80000000
mov ecx, dword [rdi]
cmp ecx, ebp
mov dword [rsp + 0x20], r10d
lea ebx, [rdx + rbp]
lea eax, [rcx - 0x80000000]
lea esi, [rcx + rbp]
cmovae esi, eax
cmp edx, ebp
lea eax, [rdx - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140040f90
lea r8, [rsp + 0x28]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140040f20
mov eax, dword [rsp + 0x20]
mov edx, dword [rsp + rax*4 + 0x24]
mov eax, edx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
jmp 0x140040fce
lea rcx, [rsp + 0x20]
inc ebx
call fcn.140043e20
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x140040fca
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140040fca
lea rcx, [rsp + 0x20]
call fcn.140043e20
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140040fb6
shr rcx, 0x20
lea edx, [rsi + rcx]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.14004d0c0
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140043e20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140043e81
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140043e40
mov ecx, dword [r9]
jmp 0x140043f68
cmp ecx, 0x4e0
jb 0x140043f68
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140043ea0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140043ef0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14004dc18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004dc62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004dc62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004dc62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004dc62
cmp dword [rcx + 0x84], 0xe
jbe 0x14004dc62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004dc64
xor al, al
add rsp, 0x28
ret

Function at 0x14004e330
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov qword [0x140093dd8], rcx
mov r9, rdx
mov qword [rsp + 0x28], rax
lea r8, [0x14004e840]
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret
Function at 0x1410a3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410a31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410a3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a306f
add dl, dl
jne 0x1410a3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a30f6
xor eax, eax
add dl, dl
jne 0x1410a30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410a31ad
add dl, dl
jne 0x1410a30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410a30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410a307e
mov eax, 1
add dl, dl
jne 0x1410a3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410a3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a30fb
sub eax, ebx
mov ebx, 1
jne 0x1410a314c
mov ecx, 1
add dl, dl
jne 0x1410a312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410a313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410a3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410a3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410a315d
cmp eax, 0x7d00
jae 0x1410a319b
cmp eax, 0x500
jb 0x1410a3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a307e
cmp eax, 0x7f
ja 0x1410a319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410a307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410a31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410a307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001827
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x120], 0
mov dword [rbp - 0x10], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x128], rax
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x1400019c4
jmp 0x1400019a3
mov rax, qword [rbp + 0x140]
lea rdx, [rbp - 0x10]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x1400019a3
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rax, [rbp - 0x14]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call rax
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.140001701
mov edx, eax
mov eax, dword [rbp - 0x14]
cmp edx, eax
sete al
test al, al
je 0x1400019a3
mov qword [rbp - 0x28], 0
mov eax, dword [rbp - 8]
mov ecx, eax
call fcn.1400014a4
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov r10, qword [0x140138080]
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x120]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call r10
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x140001987
mov rax, qword [rbp + 0x120]
cmp rax, 0xffffffffffffffff
je 0x140001987
mov rdx, qword [0x140138078]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x120]
jmp 0x1400019de
mov rdx, qword [0x140138078]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
jmp 0x1400019de
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x14000188c
mov rdx, qword [0x140138078]
mov rax, qword [rbp + 0x128]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
add rsp, 0x1b0
pop rbp
ret