joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a5f55
Capabilities:
Timestomp file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [rbp + 0x10]
movsx eax, word [rax]
mov word [rbp - 0x20], ax
mov rax, qword [rbp + 0x10]
movsx eax, byte [rax + 2]
mov word [rbp - 0x1e], ax
mov word [rbp - 0x1c], 0
mov rax, qword [rbp + 0x10]
movsx eax, byte [rax + 3]
mov word [rbp - 0x1a], ax
mov rax, qword [rbp + 0x10]
movsx eax, byte [rax + 4]
mov word [rbp - 0x18], ax
mov rax, qword [rbp + 0x10]
movsx eax, byte [rax + 5]
mov word [rbp - 0x16], ax
mov rax, qword [rbp + 0x10]
movsx eax, byte [rax + 6]
mov word [rbp - 0x14], ax
mov rax, qword [rbp + 0x10]
movsx eax, word [rax + 8]
mov word [rbp - 0x12], ax
push rax
push rax
lea rax, [rbp - 8]
push rax
lea rax, [rbp - 0x20]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
add rsp, 0x20
cmp eax, 0
jne 0x5a5fdf
int 5
push rax
push rax
lea rax, [rbp - 0x10]
push rax
lea rax, [rbp - 8]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
call qword [sym.imp.KERNEL32.DLL_LocalFileTimeToFileTime]
add rsp, 0x20
cmp eax, 0
jne 0x5a6005
int 5
lea rax, [rbp - 0x10]
push rax
lea rax, [rbp - 0x10]
push rax
lea rax, [rbp - 0x10]
push rax
movsxd rax, dword [rbp + 0x18]
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.KERNEL32.DLL_SetFileTime]
add rsp, 0x20
cmp eax, 0
jne 0x5a603d
int 5
leave
ret 0x10

Function at 0x5a8a97
Capabilities:
Enumerate processes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov r8d, 0x10
mov edx, 4
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov qword [rax], 0
mov rbx, qword [rbp + 0x10]
mov qword [rax + 8], rbx
call fcn.006defae
mov dword [rax + 4], 0x7c
mov qword [rbp - 8], rax
push rax
push qword [rbp + 0x18]
call fcn.0040b260
pop rcx
mov rax, qword [rbp + 0x18]
cmp qword [rax + 0x30], 0
jne 0x5a8b04
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 8]
mov qword [rax + 0x30], rbx
jmp 0x5a8b2b
mov rax, qword [rbp + 0x18]
mov rax, qword [rax + 0x38]
lock inc dword [rax]
cmp dword [rax + 4], 0x7c
jne 0x5a8b4c
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov rbx, qword [rbp - 8]
mov qword [rax], rbx
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 8]
mov qword [rax + 0x38], rbx
mov rax, qword [rbp + 0x18]
inc dword [rax + 0x40]
push rax
push qword [rbp + 0x18]
call fcn.0040ba36
pop rcx
leave
ret 0x10
int 5
Function at 0x5a8cdf
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x230
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov rcx, qword [rbp + 0x20]
mov edx, dword [rbp + 0x28]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
push 0x104
lea rax, [rbp - 0x118]
push rax
push qword [rbp + 0x48]
push qword [rbp + 0x40]
push 0
push rbp
call fcn.00402463
mov byte [rbp - 0x15], 0
push 0x104
lea rax, [rbp - 0x228]
push rax
push qword [rbp + 0x38]
push qword [rbp + 0x30]
push 0
push rbp
call fcn.00402463
mov byte [rbp - 0x125], 0
push rax
lea rax, [rbp - 0x10]
push rax
push 1
push 0
lea rax, [rbp - 0x118]
push rax
mov eax, dword [rbp + 0x50]
add eax, 0x80000000
cdqe
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
add rsp, 0x30
cmp eax, 0
je 0x5a8d9c
mov eax, 0xffffffff
leave
ret 0x48
mov eax, dword [rbp + 0x28]
mov dword [rbp - 8], eax
lea rax, [rbp - 8]
push rax
push qword [rbp + 0x20]
push qword [rbp + 0x10]
push 0
lea rax, [rbp - 0x228]
push rax
push qword [rbp - 0x10]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
add rsp, 0x30
mov dword [rbp - 4], eax
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.advapi32.dll_RegCloseKey]
add rsp, 0x20
cmp dword [rbp - 4], 0
je 0x5a8dfe
mov eax, 0xffffffff
leave
ret 0x48
mov rax, qword [rbp + 0x18]
mov ebx, dword [rbp - 8]
mov dword [rax], ebx
xor eax, eax
leave
ret 0x48

Function at 0x5a8e0d
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp dword [rbp + 0x18], 0x10
je 0x5a8e24
xor al, al
leave
ret 0x10
mov eax, dword [rbp + 0x18]
sub eax, 0xc
jb 0x5a8e69
mov rax, qword [rbp + 0x10]
push 0xc
push rax
call fcn.0053faee
mov dword [rbp - 4], eax
push 4
lea rax, [rbp - 4]
push rax
mov eax, dword [rbp + 0x18]
sub eax, 4
jb 0x5a8e6b
cmp eax, 0xc
jb 0x5a8e6b
mov rax, qword [rbp + 0x10]
push 4
lea rax, [rax + 0xc]
push rax
call fcn.00410e58
cmp eax, 0
sete al
leave
ret 0x10
int 5
int 5
Function at 0x5a8e6d
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x120
mov rcx, qword [rbp + 0x10]
mov edx, dword [rbp + 0x18]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
push 0x104
lea rax, [rbp - 0x120]
push rax
push qword [rbp + 0x30]
push qword [rbp + 0x28]
push 0
push rbp
call fcn.00402463
mov byte [rbp - 0x1d], 0
push rax
lea rax, [rbp - 0x10]
push rax
push 8
push 0
lea rax, [rbp - 0x120]
push rax
mov eax, dword [rbp + 0x38]
add eax, 0x80000000
cdqe
push rax
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
add rsp, 0x30
cmp eax, 0
je 0x5a8ef4
mov eax, 0xffffffff
leave
ret 0x30
mov eax, dword [rbp + 0x18]
mov dword [rbp - 8], eax
push 0
push 0
push 0
push 0
lea rax, [rbp - 8]
push rax
push qword [rbp + 0x10]
push qword [rbp + 0x20]
push qword [rbp - 0x10]
mov rcx, qword [rsp]
mov edx, dword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov r9, qword [rsp + 0x18]
call qword [sym.imp.advapi32.dll_RegEnumKeyExA]
add rsp, 0x40
mov dword [rbp - 4], eax
sub rsp, 0x18
push qword [rbp - 0x10]
mov rcx, qword [rsp]
call qword [sym.imp.advapi32.dll_RegCloseKey]
add rsp, 0x20
cmp dword [rbp - 4], 0
je 0x5a8f53
mov eax, 0xffffffff
leave
ret 0x30
xor eax, eax
leave
ret 0x30

Function at 0x5aa423
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
test byte [0x00e5d60a], 0xff
je 0x5aa495
test byte [0x0176e418], 0xff
je 0x5aa442
leave
ret
mov byte [0x0176e418], 1
push 0
push 0
mov r8d, 0x6077fe
xor r9d, r9d
xor edx, edx
xor ecx, ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateThread]
add rsp, 0x30
test rax, rax
je 0x5aa483
mov rcx, rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
add rsp, 0x20
mov eax, 0xffffffff
not eax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5aa495
mov byte [0x0176e418], 0
leave
ret

Function at 0x5c62ad
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov eax, dword [rbp + 0x18]
cmp eax, 0xa0
jae 0x5c6339
mov rbx, qword [rbp + 0x20]
imul eax, eax, 0x44
lea rax, [rbx + rax + 0x3c8]
mov qword [rbp - 0x10], rax
push qword [rbp + 0x20]
push qword [rbp + 0x18]
call fcn.006194d6
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, dword [rbp - 4]
jne 0x5c62f3
leave
ret 0x18
cmp dword [rbp - 4], 0xffffffff
jne 0x5c632c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xffffffff
test byte [rbp + 0x10], 0xff
je 0x5c632a
mov rax, qword [rbp - 0x10]
mov r8d, 0x40
mov edx, 0x70b470
lea rcx, [rax + 4]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
jmp 0x5c6335
mov rax, qword [rbp - 0x10]
mov ebx, dword [rbp - 4]
mov dword [rax], ebx
leave
ret 0x18
int 5
Function at 0x5c633b
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
push qword [rbp + 0x20]
push qword [rbp + 0x10]
call fcn.005c9081
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0xcc
jne 0x5c6417
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 4]
cmp esi, ebx
jae 0x5c6417
mov eax, dword [rax + rsi*4 + 4]
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
jmp 0x5c6401
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
lock inc dword [rax]
cmp dword [rax + 4], 0xcd
jne 0x5c6419
mov qword [rbp - 0x10], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 8]
cmp esi, ebx
jae 0x5c6419
imul esi, esi, 0x14
lea rax, [rax + rsi + 4]
mov qword [rbp - 0x18], rax
push qword [rbp + 0x20]
mov rax, qword [rbp - 0x18]
lea rax, [rax + 1]
push rax
call fcn.005c90c4
test al, al
je 0x5c63f0
mov rax, qword [rbp - 0x18]
mov rbx, qword [rbp + 0x18]
mov eax, dword [rax + 0xc]
mov dword [rbx], eax
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
mov al, 1
leave
ret 0x18
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x10]
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x10]
lock dec dword [rax]
cmp dword [rbp - 8], 0xffffffff
jne 0x5c6390
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
xor al, al
leave
ret 0x18
int 5
int 5

Function at 0x5c82ab
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x017607f0]
lea rbx, [rbp - 0x20]
push rbx
push 0
push 4
push 0
push qword [0x017608f8]
push qword [0x017607f0]
mov rax, qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [rax + 0x70]
add rsp, 0x30
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5c830b
push rax
push 5
push str.Map__
push qword [rbp - 4]
call fcn.005539b8
pop rcx
mov eax, dword [rbp + 0x18]
cmp eax, dword [rbp + 0x18]
jne 0x5c835e
mov r8d, eax
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [0x017607f0]
push rax
push 0
push qword [0x017608f8]
push qword [0x017607f0]
mov rax, qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
call qword [rax + 0x78]
add rsp, 0x20
leave
ret 0x10
int 5
Function at 0x5c8360
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x017607f0]
lea rbx, [rbp - 0x20]
push rbx
push 0
push 4
push 0
push qword [0x01760900]
push qword [0x017607f0]
mov rax, qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
mov r9d, dword [rsp + 0x18]
call qword [rax + 0x70]
add rsp, 0x30
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5c83c0
push rax
push 5
push str.Map__
push qword [rbp - 4]
call fcn.005539b8
pop rcx
mov eax, dword [rbp + 0x18]
cmp eax, dword [rbp + 0x18]
jne 0x5c8413
mov r8d, eax
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [0x017607f0]
push rax
push 0
push qword [0x01760900]
push qword [0x017607f0]
mov rax, qword [rax]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 8]
mov r8d, dword [rsp + 0x10]
call qword [rax + 0x78]
add rsp, 0x20
leave
ret 0x10
int 5

Function at 0x5c8415
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [rbp + 0x10], 0
jne 0x5c842a
leave
ret 0x10
cmp dword [rbp + 0x10], 0
jle 0x5c8556
mov rax, qword [rbp + 0x18]
cmp qword [rax], 0
jne 0x5c8442
xor eax, eax
jmp 0x5c8469
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0x65
jne 0x5c8558
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x18]
lock dec dword [rsi]
mov eax, ebx
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add eax, dword [rbp + 0x10]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0x6bca1b
jae 0x5c855a
imul eax, eax, 0x130
add eax, 8
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0x14]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 0x65
mov qword [rbp - 0x10], rax
cmp dword [rbp - 4], 0
jle 0x5c8536
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 0x65
jne 0x5c855c
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp - 4]
mov dword [rbp - 0x1c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x1c]
jb 0x5c855c
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx]
lock inc dword [rbx]
cmp dword [rbx + 4], 0x65
jne 0x5c855c
mov qword [rbp - 0x28], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
cmp esi, dword [rbp - 0x1c]
jne 0x5c855c
imul esi, esi, 0x130
mov r8d, esi
lea rdx, [rbx + 8]
lea rcx, [rax + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov ebx, 0x65
call fcn.006df099
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x10]
mov qword [rax], rbx
leave
ret 0x10
int 5
int 5
int 5
int 5
Function at 0x5c855e
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp dword [rbp + 0x10], 0
jne 0x5c8573
leave
ret 0x10
cmp dword [rbp + 0x10], 0
jle 0x5c8699
mov rax, qword [rbp + 0x18]
cmp qword [rax], 0
jne 0x5c858b
xor eax, eax
jmp 0x5c85b2
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lock inc dword [rax]
cmp dword [rax + 4], 0x64
jne 0x5c869b
mov qword [rbp - 0x18], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x18]
lock dec dword [rsi]
mov eax, ebx
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add eax, dword [rbp + 0x10]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0xfffffff
jae 0x5c869d
shl eax, 3
add eax, 8
mov r8d, eax
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
mov ebx, dword [rbp - 0x14]
mov dword [rax], ebx
call fcn.006defae
mov dword [rax + 4], 0x64
mov qword [rbp - 0x10], rax
cmp dword [rbp - 4], 0
jle 0x5c8679
mov rax, qword [rbp - 0x10]
lock inc dword [rax]
cmp dword [rax + 4], 0x64
jne 0x5c869f
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp - 4]
mov dword [rbp - 0x1c], ebx
mov rax, qword [rax + 8]
mov ebx, dword [rax]
sub ebx, dword [rbp - 0x1c]
jb 0x5c869f
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx]
lock inc dword [rbx]
cmp dword [rbx + 4], 0x64
jne 0x5c869f
mov qword [rbp - 0x28], rbx
mov rbx, qword [rbx + 8]
mov esi, dword [rbx]
cmp esi, dword [rbp - 0x1c]
jne 0x5c869f
shl esi, 3
mov r8d, esi
lea rdx, [rbx + 8]
lea rcx, [rax + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov rax, qword [rbp - 0x28]
lock dec dword [rax]
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov ebx, 0x64
call fcn.006df099
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbp - 0x10]
mov qword [rax], rbx
leave
ret 0x10
int 5
int 5
int 5
int 5
Function at 0x5c91c9
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rcx
mov rax, qword [rbp - 0x28]
lock inc dword [rax]
cmp dword [rax + 4], 0xcc
jne 0x5c92cb
mov qword [rbp - 0x30], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov rsi, qword [rbp - 0x30]
lock dec dword [rsi]
mov dword [rbp - 4], ebx
cmp dword [rbp + 0x10], 0
jle 0x5c922a
shl dword [rbp - 4], 1
jmp 0x5c922d
sar dword [rbp - 4], 1
push qword [rbp + 0x18]
push qword [rbp - 4]
push 0
push 0
call fcn.00506ab8
mov dword [rbp - 8], 0
jmp 0x5c929f
mov rax, qword [rbp - 0x20]
lock inc dword [rax]
cmp dword [rax + 4], 0xcd
jne 0x5c92cd
mov qword [rbp - 0x38], rax
mov rax, qword [rax + 8]
mov ebx, dword [rax]
mov esi, dword [rbp - 8]
cmp esi, ebx
jae 0x5c92cd
imul esi, esi, 0x14
lea rax, [rax + rsi + 4]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
test byte [rax], 0xff
je 0x5c9295
push rax
mov rax, qword [rbp - 0x40]
lea rax, [rax + 1]
push rax
mov rax, qword [rbp - 0x40]
push qword [rax + 0xc]
push qword [rbp + 0x18]
call fcn.00616bf2
pop rcx
mov rax, qword [rbp - 0x38]
lock dec dword [rax]
inc dword [rbp - 8]
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0x18]
jl 0x5c9245
mov rax, qword [rbp + 0x18]
mov bl, byte [rbp - 0xc]
mov byte [rax + 0x1c], bl
mov rax, qword [rbp + 0x18]
mov bl, byte [rbp - 0xb]
mov byte [rax + 0x1d], bl
push rax
lea rax, [rbp - 0x28]
push rax
call fcn.00619d49
pop rcx
leave
ret 0x10
int 5
int 5

Function at 0x5d0bc3
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
jmp 0x5d0c1c
push rax
mov eax, dword [rbp - 0xc]
cmp eax, 3
jae 0x5d0c29
mov rbx, qword [rbp + 0x18]
mov esi, dword [rbp - 0xc]
cmp esi, 3
jae 0x5d0c29
mov rdi, qword [rbp + 0x10]
mov eax, dword [rbx + rax*4]
sub eax, dword [rdi + rsi*4]
push rax
call fcn.00494081
pop rcx
mov dword [rsp], eax
fild dword [rsp]
fstp dword [rbp - 4]
fld dword [rbp - 4]
fmul dword [rbp - 4]
fadd dword [rbp - 8]
fstp dword [rbp - 8]
inc dword [rbp - 0xc]
cmp dword [rbp - 0xc], 3
jl 0x5d0bde
fld dword [rbp - 8]
leave
ret 0x10
int 5

Function at 0x5d0c2b
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rcx, [rbp - 0x40]
mov edx, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 0x40], 0x40
sub rsp, 0x18
lea rax, [rbp - 0x40]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
leave
ret
Function at 0x5e8366
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x5e8389
xor eax, eax
leave
ret 0x28
mov rax, qword [rbp + 0x30]
mov rbx, qword [rbp + 0x20]
cmp rbx, qword [rax + 0x4a0]
jl 0x5e83a0
xor eax, eax
leave
ret 0x28
cmp dword [rbp + 0x28], 0x3f
jg 0x5e844e
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
lea rax, [rax + 8]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x28], 0
je 0x5e8404
push rax
push qword [rbp + 0x30]
mov eax, dword [rbp + 0x28]
inc eax
push rax
push qword [rbp + 0x20]
push qword [rbp - 0x18]
push qword [rbp + 0x10]
call fcn.005e8366
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e8404
mov eax, dword [rbp - 4]
leave
ret 0x28
cmp qword [rbp - 0x30], 0
je 0x5e844c
push rax
push qword [rbp + 0x30]
mov eax, dword [rbp + 0x28]
inc eax
push rax
mov eax, 0x3f
sub eax, dword [rbp + 0x28]
cdqe
mov rbx, 1
mov ecx, eax
shl rbx, cl
add rbx, qword [rbp + 0x20]
push rbx
push qword [rbp - 0x20]
push qword [rbp + 0x10]
call fcn.005e8366
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e844c
mov eax, dword [rbp - 4]
leave
ret 0x28
jmp 0x5e84aa
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
test byte [rax + 5], 0xff
je 0x5e84aa
mov rax, qword [rbp - 0x38]
movzx eax, byte [rax + 4]
cmp eax, 0
jne 0x5e84aa
mov rax, qword [rbp - 0x38]
test byte [rax + 6], 0xff
jne 0x5e84aa
mov rax, qword [rbp - 0x38]
test byte [rax + 7], 0xff
je 0x5e84b0
push qword [rbp + 0x30]
push qword [rbp + 0x20]
push qword [rbp - 0x38]
push qword [rbp + 0x10]
call fcn.0062cdac
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e84a2
mov eax, dword [rbp - 4]
leave
ret 0x28
mov rax, qword [rbp - 0x38]
mov byte [rax + 6], 1
xor eax, eax
leave
ret 0x28
int 5
Function at 0x5e87d3
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rax, qword [rbp + 0x10]
test byte [rax + 0x6a8], 0xff
je 0x5e8869
push rax
mov rax, qword [rbp + 0x10]
push qword [rax]
call fcn.004c130f
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e8808
mov eax, dword [rbp - 4]
leave
ret 8
mov rax, qword [rbp + 0x10]
mov byte [rax + 0x227], 1
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0x228], 0
je 0x5e886f
push rax
mov rax, qword [rbp + 0x10]
push qword [rax]
push 0
mov rax, qword [rbp + 0x10]
lea rax, [rax + 0x220]
push rax
call fcn.004c10c7
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e884c
mov eax, dword [rbp - 4]
leave
ret 8
push rax
mov rax, qword [rbp + 0x10]
push qword [rax]
call fcn.004c130f
pop rcx
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jge 0x5e8869
mov eax, dword [rbp - 4]
leave
ret 8
xor eax, eax
leave
ret 8
int 5

Function at 0x5e89f6
Capabilities:
Get memory capacity

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rcx, [rbp - 0x40]
mov edx, 0x40
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
add rsp, 0x20
mov dword [rbp - 0x40], 0x40
sub rsp, 0x18
lea rax, [rbp - 0x40]
push rax
mov rcx, qword [rsp]
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
add rsp, 0x20
mov eax, dword [rbp - 0x3c]
leave
ret
Function at 0x603cbf
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [rbp + 0x18]
mov dword [rbp - 4], eax
cmp qword [0x02d29838], 0
jne 0x603dd6
push 0x2d29840
push 1
call fcn.00425894
cmp eax, 0
jne 0x603db7
mov r8d, 0x400
mov edx, 0xc
mov rcx, qword [section..bss]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_HeapAlloc]
add rsp, 0x20
call fcn.006defae
mov dword [rax + 4], 0x11c
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
jmp 0x603da1
mov eax, dword [rbp - 0xc]
mov dword [rbp - 8], eax
mov dword [rbp - 0x10], 0
jmp 0x603d60
mov eax, dword [rbp - 8]
and eax, 1
cmp eax, 0
je 0x603d55
mov eax, dword [rbp - 8]
shr eax, 1
xor eax, 0xedb88320
mov dword [rbp - 8], eax
jmp 0x603d5d
mov eax, dword [rbp - 8]
shr eax, 1
mov dword [rbp - 8], eax
inc dword [rbp - 0x10]
cmp dword [rbp - 0x10], 8
jl 0x603d3b
mov rax, qword [rbp - 0x18]
lock inc dword [rax]
cmp dword [rax + 4], 0x11c
jne 0x603e53
mov qword [rbp - 0x20], rax
mov ebx, dword [rbp - 0xc]
cmp ebx, 0x100
jae 0x603e53
mov rax, qword [rax + 8]
mov esi, dword [rbp - 8]
mov dword [rax + rbx*4], esi
mov rax, qword [rbp - 0x20]
lock dec dword [rax]
inc dword [rbp - 0xc]
cmp dword [rbp - 0xc], 0x100
jb 0x603d2c
mov rax, qword [rbp - 0x18]
mov qword [0x02d29838], rax
jmp 0x603dd6
jmp 0x603dcc
mov ecx, 0xa
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_Sleep]
add rsp, 0x20
cmp qword [0x02d29838], 0
je 0x603db9
mov rax, qword [rbp + 0x20]
mov eax, dword [rax]
not eax
mov dword [rbp - 8], eax
mov dword [rbp - 0xc], 0
jmp 0x603e3c
mov rax, qword [0x02d29838]
lock inc dword [rax]
cmp dword [rax + 4], 0x11c
jne 0x603e55
mov qword [rbp - 0x18], rax
mov ebx, dword [rbp - 0xc]
cmp ebx, dword [rbp + 0x18]
jae 0x603e55
mov rsi, qword [rbp + 0x10]
movzx ebx, byte [rsi + rbx]
xor ebx, dword [rbp - 8]
and ebx, 0xff
cmp ebx, 0x100
jae 0x603e55
mov rax, qword [rax + 8]
mov esi, dword [rbp - 8]
shr esi, 8
xor esi, dword [rax + rbx*4]
mov rax, qword [rbp - 0x18]
lock dec dword [rax]
mov dword [rbp - 8], esi
inc dword [rbp - 0xc]
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp - 4]
jb 0x603dea
mov eax, dword [rbp - 8]
not eax
mov rbx, qword [rbp + 0x20]
mov dword [rbx], eax
leave
ret 0x18
int 5
int 5