joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590237
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x59014e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x590229
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x5900c2
mov rax, rdx
mov rcx, rsi
call fcn.00466400
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x59012a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005904c0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x590221
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x590154
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x5901d1
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.005904c0
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x59020f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x59020b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00466400
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00465b20
mov rax, rdx
mov ecx, 0x40
call fcn.00465b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00590020
Function at 0x5f47a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5f4875
movdqa xmm0, xmmword [0x0073ddc0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5f47e1
movdqa xmm0, xmmword [0x0073ddd0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5f48f7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5f48cb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0073d5e8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0073e250]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x602120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6022cb
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x602147
inc rcx
cmp rbx, rcx
jle 0x6022bd
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x602144
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.004f4820
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008c9f28]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005fe1e0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x6022ad
test rdx, rdx
je 0x60229e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x0092a088]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x602269
xor eax, eax
lea rbx, [0x0073bf58]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c5a6e]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e8e0
jmp 0x602290
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073be00]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e800
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00602120
Function at 0x140033860
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003386d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003387d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140033865
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140033895
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140033882
sub eax, 3
jb 0x1400338af
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400338e6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400338d6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400338d4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400338c3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140033822
jmp 0x14003386d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1a600
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140033932
cmp rsi, rcx
jae 0x14003393a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140033919
cmp al, 0x8f
ja 0x140033919
cmp byte [rsi - 2], 0xf
je 0x14003391f
sub al, 0xe8
cmp al, 1
ja 0x140033903
cmp rsi, rcx
jae 0x14003393a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140033909
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003393a
lodsb al, byte [rsi]
jmp 0x140033919
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x31000]
mov eax, dword [rdi]
or eax, eax
je 0x140033997
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x331dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140033947
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140033991
mov qword [rbx], rax
add rbx, 8
jmp 0x140033967
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400339d1
cmp al, 0xef
ja 0x1400339c3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400339a3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400339b2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140033a25
sub rsp, 0xffffffffffffff80
jmp 0x1400056e0
Function at 0x1409d6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409d61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409d6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d606f
add dl, dl
jne 0x1409d6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d60f6
xor eax, eax
add dl, dl
jne 0x1409d60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409d61ad
add dl, dl
jne 0x1409d60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409d60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409d607e
mov eax, 1
add dl, dl
jne 0x1409d6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409d6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d60fb
sub eax, ebx
mov ebx, 1
jne 0x1409d614c
mov ecx, 1
add dl, dl
jne 0x1409d612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409d613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409d6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409d6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409d615d
cmp eax, 0x7d00
jae 0x1409d619b
cmp eax, 0x500
jb 0x1409d6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d607e
cmp eax, 0x7f
ja 0x1409d619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409d607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409d61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409d607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
sub rsp, 0x248
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001032
mov eax, dword [0x140002260]
xor edx, edx
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 6
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001090
add rsp, 0x248
ret

Function at 0x140001958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019a4
xor al, al
add rsp, 0x28
ret
Function at 0x140134013
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x1401b1840
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1406d5129]
call fcn.14013cce5
nop
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x18]
mov rcx, qword [rbp + 0xf0]
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rbp + 0xf0]
mov rdx, qword [rdx + 8]
mov r8, qword [rbp + 0xf0]
mov r8, qword [r8]
mov qword [rbp + 0xc0], r8
mov r9d, dword [rax]
mov r8d, dword [rcx]
mov rdx, qword [rdx]
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_recv]
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140134a31
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401b5c60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1406d5120]
call fcn.14013cce5
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1401b5c9e
mov rcx, qword [rbp + 0x100]
call fcn.140134ef0
nop
jmp 0x1401b5cba
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1401b5cba
mov rcx, qword [rbp + 0x100]
call fcn.140137bf0
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140134ad6
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401cf680
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1406d50cb]
call fcn.14013cce5
nop
mov qword [rbp + 8], 0
jmp 0x1401cf6bf
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401cf715
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401cf6b4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140135008
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1401bcf40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x14069d5c0]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1406d5144]
call fcn.14013cce5
nop
xor edx, edx
mov ecx, 2
call fcn.1401379b6
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1401bcfa5
xor al, al
jmp 0x1401bd010
mov dword [rbp + 0x30], 0x130
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14013b129
test eax, eax
jne 0x1401bcfcc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
jmp 0x1401bd010
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x250]
call fcn.140136d90
movzx eax, al
test eax, eax
je 0x1401bcff2
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov al, 1
jmp 0x1401bd010
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14013cd8f
test eax, eax
jne 0x1401bcfcc
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403ca0d0]
call fcn.14013b1e7
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140137add
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x140135373
Capabilities:
Terminate process

Disassembly:
jmp 0x1401b9440
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1406d5140]
call fcn.14013cce5
nop
cmp qword [rbp + 0xe8], 0
je 0x1401b9492
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x1401b9492
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x1401b94b2
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x1401b94e6
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140136539
Capabilities:
Resolve dns

Disassembly:
jmp 0x1401fefb0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x112
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6e8]
mov rax, qword [0x14069d5c0]
xor rax, rbp
mov qword [rbp + 0x670], rax
lea rcx, [0x1406d5129]
call fcn.14013cce5
nop
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 2
jne 0x1401ff036
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1401ff06b
mov rax, qword [rbp + 0x6a0]
movzx eax, word [rax]
cmp eax, 0x17
jne 0x1401ff064
mov rax, qword [rbp + 0x6a0]
movzx ecx, word [rax + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov rcx, qword [rbp + 0x6b8]
mov dword [rcx], eax
jmp 0x1401ff06b
xor al, al
jmp 0x1401ff0f7
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x401
rep stosb byte [rdi], al
lea rcx, [rbp + 0x10]
call fcn.14013d041
mov dword [rbp + 0x664], eax
lea rcx, [rbp + 0x10]
call fcn.14013729f
mov qword [rbp + 0x668], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x664]
mov r8, qword [rbp + 0x668]
mov edx, dword [rbp + 0x6a8]
mov rcx, qword [rbp + 0x6a0]
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1401ff0dc
xor al, al
jmp 0x1401ff0f7
lea rcx, [rbp + 0x10]
call fcn.14013729f
mov rdx, rax
mov rcx, qword [rbp + 0x6b0]
call fcn.14013358c
nop
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1403c5a70]
call fcn.14013b1e7
mov rax, rdi
mov rcx, qword [rbp + 0x670]
xor rcx, rbp
call fcn.140137add
lea rsp, [rbp + 0x688]
pop rdi
pop rbp
ret

Function at 0x140136624
Capabilities:
Get geographical location

Disassembly:
jmp 0x140293870
push rdi
sub rsp, 0x30
call fcn.140138afa
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14029389c
mov eax, 2
jmp 0x140293909
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov r9d, 2
lea r8, [rsp + 0x24]
mov edx, 0x22
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x30
je 0x1402938f2
cmp dword [rsp + 0x20], 0x31
je 0x1402938f9
cmp dword [rsp + 0x20], 0x32
je 0x140293900
jmp 0x140293907
mov eax, 2
jmp 0x140293909
mov eax, 1
jmp 0x140293909
mov eax, 3
jmp 0x140293909
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140137579
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1402bb3e0
mov rax, rcx
neg rcx
test rax, 7
je 0x1402bb3fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1402bb458
test al, 7
jne 0x1402bb3f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1402bb411
mov rdx, qword [rax - 8]
test dl, dl
je 0x1402bb482
test dh, dh
je 0x1402bb47c
shr rdx, 0x10
test dl, dl
je 0x1402bb476
test dh, dh
je 0x1402bb470
shr rdx, 0x10
test dl, dl
je 0x1402bb46a
test dh, dh
je 0x1402bb464
shr edx, 0x10
test dl, dl
je 0x1402bb45e
test dh, dh
jne 0x1402bb411
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1401375dd
Capabilities:
Query environment variable

Disassembly:
jmp 0x140381210
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140380d90
lea rcx, [rsp + 0x20]
call fcn.140380de0
movzx eax, al
test eax, eax
jne 0x140381255
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140380dc0
mov rax, qword [rsp + 0x40]
jmp 0x14038134f
lea rcx, [rsp + 0x20]
call fcn.140380ee0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140380e80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140137cb8
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14013696c
lea rcx, [rsp + 0x28]
call fcn.140138636
movzx eax, al
test eax, eax
jne 0x1403812ef
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14013add7
lea rcx, [rsp + 0x20]
call fcn.140380dc0
mov rax, qword [rsp + 0x50]
jmp 0x14038134f
lea rcx, [rsp + 0x20]
call fcn.140380ee0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14013cb23
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140137b46
lea rcx, [rsp + 0x28]
call fcn.14013dd4d
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14013add7
lea rcx, [rsp + 0x20]
call fcn.140380dc0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret