joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ad50
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40e158
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40ad50

Function at 0x40ada0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rsi, rcx
mov rcx, rdx
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea ebx, [rax + 1]
cdqe
mov byte [rbp + rax], 0xa
test ebx, ebx
jle 0x40ae4a
mov r12, qword [sym.imp.WS2_32.dll_select]
xor edi, edi
lea r14, [rsp + 0x40]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x34]
nop word [rax + rax]
mov rcx, qword [rsi + 0x118]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], r13
inc ecx
xor r9d, r9d
xor edx, edx
mov r8, r14
mov dword [rsp + 0x40], 1
call r12
test eax, eax
jle 0x40ae5d
mov rcx, qword [rsi + 8]
lea rdx, [rbp + rdi]
mov r9, r15
movsxd r8, ebx
call qword [sym.imp.libcurl_4.dll_curl_easy_send]
test eax, eax
jne 0x40ae58
movsxd rdx, dword [rsp + 0x34]
sub ebx, edx
add rdi, rdx
test ebx, ebx
jg 0x40adf0
mov eax, 1
jmp 0x40ae5f
cmp eax, 0x51
je 0x40adf0
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40c410
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x138
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov r13, rdx
mov qword [rsp + 0x28], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c730
mov r8, rbx
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
mov edx, 0x2712
mov rcx, rax
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
lea rsi, [rsp + 0x30]
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040ace0]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x007a7570]
mov r8, qword [rax]
test r8, r8
je 0x40c6c0
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x007a7580]
mov edx, 0x65
mov r8d, dword [rax]
mov rcx, r12
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c710
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c683
cmp qword [rsp + 0x28], 0
jne 0x40c6b0
lea rdx, str.Empty_data_received_for_config
xor ecx, ecx
call fcn.0040aeb0
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x138
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.006f1c90
mov r13, rax
jmp 0x40c694
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c660
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c750
call sub.msvcrt.dll_getenv
mov r8, rax
mov rcx, r12
mov edx, 0x2714
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c671
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
xor ecx, ecx
call fcn.0040aeb0
xor r13d, r13d
jmp 0x40c694
lea rdx, str.Remote_config_init_failed_
xor ecx, ecx
call fcn.0040aeb0
xor r13d, r13d
jmp 0x40c69d
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c770
lea rcx, str.ALL_PROXY
jmp 0x40c6e9
lea r8, [0x00739cf4]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c660
Function at 0x40e140
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], edx
inc ecx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40e158
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40ad50
Function at 0x40e170
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa88
mov edx, 0xa
mov rdi, qword [rcx + 0x128]
mov rbx, rcx
mov rcx, rdi
call sub.msvcrt.dll_strchr
mov r12, rax
test rax, rax
je 0x40e220
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdx, [0x0073a25a]
mov rcx, rdi
mov rsi, rax
call sub.msvcrt.dll_strtok
mov r12, rax
test rax, rax
je 0x40e438
mov rcx, rax
call sub.msvcrt.dll__strdup
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
mov rcx, qword [rbx + 0x128]
cmp rdx, rsi
jl 0x40e2c0
mov byte [rcx], 0
mov rax, qword [0x007a7560]
cmp byte [rax], 0
jne 0x40e2a0
mov rax, r12
add rsp, 0xa88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [sym.imp.msvcrt.dll__time64]
lea rcx, [rsp + 0x58]
call rbp
mov rcx, qword [rbx + 0x118]
lea r15, [rsp + 0x70]
mov qword [rsp + 0x288], rcx
mov dword [rsp + 0x280], 1
mov qword [rsp + 0x70], 0x3c
mov qword [rsp + 0x20], r15
mov rax, qword [sym.imp.WS2_32.dll_select]
lea rsi, [rsp + 0x280]
inc ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x38], rax
call rax
test eax, eax
jg 0x40e2d8
lea rdx, str.stratum_recv_line_timed_out
mov ecx, 1
call fcn.0040b1a0
jmp 0x40e202
mov r8, r12
lea rdx, str.___s
mov ecx, 4
call fcn.0040b1a0
jmp 0x40e202
sub rsi, rax
add rdx, rcx
lea r8, [rsi + 1]
call sub.msvcrt.dll_memmove
jmp 0x40e1f2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov r13, qword [sym.imp.libcurl_4.dll_curl_easy_recv]
lea r14, [rsp + 0x60]
jmp 0x40e36e
cmp qword [rsp + 0x60], 0
je 0x40e3df
mov r8, qword [rbx + 0x128]
mov rcx, r8
mov qword [rsp + 0x48], r8
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov rdi, rax
call sub.msvcrt.dll_strlen
lea rdx, [rdi + rax + 1]
cmp rdx, qword [rbx + 0x120]
mov r8, qword [rsp + 0x48]
jae 0x40e3f8
lea rcx, [r8 + rdi]
mov rdx, rsi
call sub.msvcrt.dll_strcpy
xor ecx, ecx
call rbp
sub rax, qword [rsp + 0x58]
cmp rax, 0x3b
jg 0x40e428
mov rdi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x40e1a2
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
mov r9, r14
mov r8d, 0x7fc
mov rdx, rsi
call r13
test eax, eax
je 0x40e2f0
cmp eax, 0x51
jne 0x40e3df
mov rcx, qword [rbx + 0x118]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x68], 1
mov rax, qword [rsp + 0x38]
inc ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
call rax
test eax, eax
jg 0x40e33e
lea rdx, str.stratum_recv_line_failed
mov ecx, 1
call fcn.0040b1a0
jmp 0x40e202
and rdx, 0xfffffffffffff800
add rdx, 0x800
mov qword [rbx + 0x120], rdx
mov rcx, r8
call sub.msvcrt.dll_realloc
mov qword [rbx + 0x128], rax
mov r8, rax
jmp 0x40e332
mov rdi, qword [rbx + 0x128]
jmp 0x40e1a2
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
xor ecx, ecx
call fcn.0040aeb0
jmp 0x40e202
Function at 0x414fe0
Capabilities:
Manipulate user privileges

Disassembly:
push r13
push r12
push rbx
add rsp, 0xffffffffffffff80
call fcn.00414eb0
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x415008
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41507a
lea r12, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, 1
xor r9d, r9d
xor r8d, r8d
call rbx
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x4150a0
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Huge_Pages:_Failed_token_query.
mov ecx, 2
call fcn.0040b1a0
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x50]
mov r8, rax
mov edx, 1
mov r13, rax
call rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x41507a
xor ecx, ecx
lea r9, [rsp + 0x38]
mov r8d, 0xf0fff
mov rdx, r12
mov qword [r12], 0
mov qword [r12 + 8], 0
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], 0
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x415140
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
lea rcx, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
lea edx, [rax + rax]
lea r8, str.SeLockMemoryPrivilege
lea eax, [rax + rax + 2]
mov word [rsp + 0x40], dx
mov ecx, 2
lea rdx, str.LSA:__s
mov word [rsp + 0x42], ax
mov qword [rsp + 0x48], r8
call fcn.0040b1a0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [r13]
mov r9d, 1
lea r8, [rsp + 0x40]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov ecx, eax
test eax, eax
jne 0x4151d8
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_is_required_to_use_it
mov ecx, 2
call fcn.0040b1a0
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00414eb0
test eax, eax
setne al
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov r8d, eax
lea rdx, str.Huge_pages:_Failed_to_add_account_rights__lu
mov ecx, 2
call fcn.0040b1a0
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
jmp 0x415125
Function at 0x415300
Capabilities:
Delete service
Stop service

Disassembly:
push r12
push rbx
sub rsp, 0x48
mov rcx, qword [0x00733100]
cmp rcx, 0xffffffffffffffff
je 0x41531a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x007bce48]
test rcx, rcx
je 0x4153b0
movzx r12d, byte [0x007bce40]
test r12b, r12b
je 0x415358
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, r12d
mov qword [0x007bce48], 0
add rsp, 0x48
pop rbx
pop r12
ret
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [0x007bce48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x415390
test ebx, ebx
setne r12b
mov rcx, qword [0x007bce48]
jmp 0x415337
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_remove_WinRing0_driver__error__u
xor ecx, ecx
call fcn.0040b1a0
jmp 0x415381
mov r12d, 1
mov eax, r12d
add rsp, 0x48
pop rbx
pop r12
ret
Function at 0x415740
Capabilities:
Create service
Query service configuration
Query service status
Start service

Disassembly:
push rbx
sub rsp, 0x50
xor r8d, r8d
mov eax, r8d
mov ecx, r8d
mov byte [rsp + 0x3f], 0
cpuid
mov eax, 1
mov dword [rsp + 0x3b], ecx
mov dword [rsp + 0x33], ebx
mov dword [rsp + 0x37], edx
mov ecx, r8d
cpuid
mov dword [rsp + 0x4c], edx
movabs rdx, 0x69746e6568747541
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
cmp qword [rsp + 0x33], rdx
je 0x4157c0
movabs rax, 0x49656e69756e6547
cmp qword [rsp + 0x33], rax
je 0x415800
call fcn.004153d0
test al, al
je 0x4157b7
lea rdx, str.Unrecognised_CPU__skipping_MSR_setup.
mov ecx, 2
call fcn.0040b1a0
xor eax, eax
add rsp, 0x50
pop rbx
ret
cmp dword [rsp + 0x3b], 0x444d4163
jne 0x41578c
mov edx, eax
mov ecx, eax
sar edx, 8
sar ecx, 0x14
and edx, 0xf
movzx ecx, cl
add edx, ecx
cmp edx, 0x16
jle 0x41579d
cmp edx, 0x17
je 0x415848
cmp edx, 0x19
je 0x415818
lea rdx, str.MSR_None
mov ecx, 2
call fcn.0040b1a0
jmp 0x41579d
cmp dword [rsp + 0x3b], 0x6c65746e
jne 0x41579d
add rsp, 0x50
pop rbx
jmp fcn.004153d0
lea rdx, str.MSR_Ryzen_v2
mov ecx, 2
call fcn.0040b1a0
lea rdx, str.Arch_Zen2
mov ecx, 2
call fcn.0040b1a0
nop
add rsp, 0x50
pop rbx
jmp fcn.004153d0
lea rdx, str.MSR_Ryzen_v1
mov ecx, 2
mov dword [rsp + 0x2c], eax
call fcn.0040b1a0
mov eax, dword [rsp + 0x2c]
mov edx, eax
shr edx, 0xc
sar eax, 4
and edx, 0xf0
and eax, 0xf
or eax, edx
cmp eax, 0x20
jg 0x415898
test eax, eax
je case.0x415890.0
cmp eax, 0x20
ja case.0x415890.0
lea rdx, [0x0073c758]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp eax, 0x31
je 0x415829
sub eax, 0x60
cmp eax, 0x30
ja case.0x415890.0
movabs rdx, 0x1000000020001
bt rdx, rax
jae case.0x415890.0
jmp 0x415829
lea rdx, [0x0073c6e9]
jmp 0x415830
lea rdx, str.Arch_Zen
jmp 0x415830
Function at 0x4158e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, 2
mov rdx, qword [rcx]
mov rsi, rcx
shrx rax, qword [rdx], rax
mov qword [rdx + 0x28], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov eax, 4
mov rdx, qword [rcx]
shlx rax, qword [rdx + 0x20], rax
mov qword [rdx + 0x10], rax
mov edx, 1
mov rbx, qword [rcx]
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_calloc
mov qword [rbx + 0x18], rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
lea rdx, [rdi*4]
cmp rdx, rcx
jbe 0x415ae8
lea r8, [rcx*4 - 4]
mov r9, rcx
lea rbp, [0x0073cf00]
lea r12, [0x0073d000]
jmp 0x415a34
mov r15d, ebx
mov r14d, ebx
movzx eax, bh
shr r15d, 0x10
shr r14d, 0x18
mov r11d, eax
mov edi, r14d
mov eax, r15d
cmp r9, 6
jbe 0x4159ba
cmp rdx, 4
je 0x415b00
mov rdx, rcx
sub rdx, r9
xor r10b, byte [r13 + rdx*4]
mov byte [r13 + rcx*4], r10b
mov rbx, rcx
mov r9, qword [rsi]
mov rdx, qword [r9 + 0x18]
sub rbx, qword [r9 + 0x28]
xor r11b, byte [rdx + rbx*4 + 1]
mov byte [rdx + r8 + 5], r11b
mov rbx, rcx
mov r9, qword [rsi]
mov rdx, qword [r9 + 0x18]
sub rbx, qword [r9 + 0x28]
xor al, byte [rdx + rbx*4 + 2]
mov byte [rdx + r8 + 6], al
mov rbx, rcx
inc rcx
mov rdx, qword [rsi]
mov rax, qword [rdx + 0x18]
sub rbx, qword [rdx + 0x28]
xor dil, byte [rax + rbx*4 + 3]
mov byte [rax + r8 + 7], dil
add r8, 4
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
lea rdx, [rdi*4]
cmp rdx, rcx
jbe 0x415ae8
mov r9, qword [rax + 0x28]
mov r13, qword [rax + 0x18]
xor edx, edx
mov rax, rcx
div r9
mov ebx, dword [r13 + r8]
mov dword [rsp + 0x28], ebx
mov r10d, ebx
mov r14, rax
test rdx, rdx
jne 0x415990
movzx eax, word [rsp + 0x29]
mov byte [rsp + 0x2f], bl
mov word [rsp + 0x2c], ax
movzx eax, byte [rsp + 0x2b]
mov byte [rsp + 0x2e], al
mov edx, dword [rsp + 0x2c]
movzx eax, dh
mov r10d, eax
movzx eax, dh
and eax, 0xf0
and r10d, 0xf
add rax, rbp
movzx r11d, byte [rax + r10]
mov eax, edx
shr eax, 0x10
mov r10d, eax
and eax, 0xf0
and r10d, 0xf
add rax, rbp
movzx eax, byte [rax + r10]
mov r10d, edx
shr r10d, 0x18
mov ebx, r10d
and r10d, 0xf0
add r10, rbp
and ebx, 0xf
movzx edi, byte [r10 + rbx]
mov r10d, edx
and edx, 0xf0
and r10d, 0xf
add rdx, rbp
movzx r10d, byte [rdx + r10]
xor r10b, byte [r12 + r14 - 1]
jmp 0x4159ba
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, ebx
and ebx, 0xf0
lea rax, [rbp + rbx]
and edx, 0xf
movzx r10d, byte [rax + rdx]
mov rdx, r11
and r11d, 0xf0
and edx, 0xf
lea rax, [rbp + r11]
movzx r11d, byte [rax + rdx]
mov edx, r15d
and r15d, 0xf0
and edx, 0xf
mov ebx, r14d
lea rax, [rbp + r15]
and r14d, 0xf0
movzx eax, byte [rax + rdx]
and ebx, 0xf
lea rdx, [rbp + r14]
movzx edi, byte [rdx + rbx]
jmp 0x4159ba
Function at 0x41d120
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov edx, dword [rcx + 0x30]
mov eax, dword [rcx + 0x38]
mov rbx, rcx
mov ecx, edx
mov byte [rsp + 0x60], r8b
xor r8d, r8d
add ecx, eax
setb r8b
add r8d, dword [rbx + 0x34]
mov byte [rsp + 0x68], r9b
movbe dword [rsp + 0x28], r8d
movbe dword [rsp + 0x2c], ecx
cmp eax, 0x1b8
je 0x41d300
cmp eax, 0x1b7
jg 0x41d2b0
test eax, eax
je 0x41d2a0
sub ecx, 0x1b8
mov dword [rbx + 0x30], ecx
mov r8d, 0x1b8
sub r8d, eax
movsxd r8, r8d
lea rdx, [0x0073d9c0]
mov rcx, rbx
call fcn.0041ceb0
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call fcn.0041ceb0
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
mov dword [rbx + 0x30], eax
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbx
call fcn.0041ceb0
movzx eax, byte [rbx + 3]
mov byte [rsi], al
movzx eax, word [rbx + 2]
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x41d176
sub ecx, 0x200
mov dword [rbx + 0x30], ecx
mov r8d, 0x200
sub r8d, eax
movsxd r8, r8d
lea rdx, [0x0073d9c0]
mov rcx, rbx
call fcn.0041ceb0
sub dword [rbx + 0x30], 0x1b8
mov r8d, 0x1b8
lea rdx, [0x0073d9c1]
mov rcx, rbx
call fcn.0041ceb0
mov dword [rbx + 0x3c], 1
jmp 0x41d19a
sub edx, 8
mov dword [rbx + 0x30], edx
mov r8d, 8
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.0041ceb0
mov eax, dword [rbx + 0x30]
jmp 0x41d1b3
Function at 0x42ea00
Capabilities:
Hash data using sha512

Disassembly:
push r14
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebp, dword [rcx + 0xe0]
mov rbx, rcx
lea rax, [rbp + r8]
mov r12, rdx
mov rdi, r8
lea rcx, [rbp + 0x60]
cmp rax, 0x80
ja 0x42ea50
add rcx, rbx
mov r8, rdi
mov rdx, r12
call sub.msvcrt.dll_memcpy
add dword [rbx + 0xe0], edi
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r14
ret
mov esi, pe_nt_image_headers64
sub rsi, rbp
add rcx, rbx
cmp rsi, 0x20
jae 0x42eb50
test sil, 0x10
jne 0x42ebed
test sil, 8
jne 0x42ec0e
test sil, 4
jne 0x42ec23
test rsi, rsi
je 0x42eaa0
movzx eax, byte [rdx]
mov byte [rcx], al
test sil, 2
jne 0x42ec34
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
lea rdx, [rbx + 0x60]
sub rax, 0xffffffffffffff80
cmp rax, 0x7f
mov qword [rbx + 0x40], rax
setbe al
movzx eax, al
add qword [rbx + 0x48], rax
mov rcx, rbx
lea rdi, [rbp + rdi - 0x80]
add rsi, r12
call fcn.0042e530
mov dword [rbx + 0xe0], 0
cmp rdi, 0x80
jbe 0x42ebe0
lea rbp, [rdi - 0x81]
shr rbp, 7
lea r12, [rbp + 1]
shl r12, 7
add r12, rsi
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov rdx, rsi
sub rax, 0xffffffffffffff80
cmp rax, 0x7f
mov qword [rbx + 0x40], rax
setbe al
movzx eax, al
add qword [rbx + 0x48], rax
mov rcx, rbx
sub rsi, 0xffffffffffffff80
call fcn.0042e530
cmp rsi, r12
jne 0x42eb00
mov ecx, dword [rbx + 0xe0]
neg rbp
shl rbp, 7
lea rdi, [rdi + rbp - 0x80]
add rcx, 0x60
jmp 0x42ea2c
mov rax, qword [rdx]
mov r8, r12
mov qword [rcx], rax
mov rax, qword [rdx + rsi - 0x20]
mov qword [rcx + rsi - 0x20], rax
mov rax, qword [rdx + rsi - 0x18]
mov qword [rcx + rsi - 0x18], rax
mov rax, qword [rdx + rsi - 0x10]
mov qword [rcx + rsi - 0x10], rax
mov rax, qword [rdx + rsi - 8]
lea rdx, [rcx + 8]
and rdx, 0xfffffffffffffff8
mov qword [rcx + rsi - 8], rax
sub rcx, rdx
sub r8, rcx
add rcx, rsi
and rcx, 0xffffffffffffffe0
cmp rcx, 0x20
jb 0x42eaa0
and rcx, 0xffffffffffffffe0
xor eax, eax
mov r11, qword [r8 + rax + 8]
mov r10, qword [r8 + rax + 0x10]
mov r9, qword [r8 + rax + 0x18]
mov r14, qword [r8 + rax]
mov qword [rdx + rax + 8], r11
mov qword [rdx + rax], r14
mov qword [rdx + rax + 0x10], r10
mov qword [rdx + rax + 0x18], r9
add rax, 0x20
cmp rax, rcx
jb 0x42eba6
jmp 0x42eaa0
mov r12, rsi
mov ecx, 0x60
jmp 0x42ea2c
vmovdqu8 xmm0, xmmword [rdx]
vmovdqu8 xmmword [rcx], xmm0
vmovdqu8 xmm1, xmmword [rdx + rsi - 0x10]
vmovdqu8 xmmword [rcx + rsi - 0x10], xmm1
jmp 0x42eaa0
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rdx + rsi - 8]
mov qword [rcx + rsi - 8], rax
jmp 0x42eaa0
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rdx + rsi - 4]
mov dword [rcx + rsi - 4], eax
jmp 0x42eaa0
movzx eax, word [rdx + rsi - 2]
mov word [rcx + rsi - 2], ax
jmp 0x42eaa0
Function at 0x42edf0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov r10, rdx
test rcx, rcx
je 0x42ef1a
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x42eef0
xor eax, eax
mov word [rsp + 0x3e], ax
lea rax, [rcx + 0x48]
mov byte [rsp + 0x20], dl
and rax, 0xfffffffffffffff8
mov edx, ecx
sub edx, eax
lea r9d, [rdx + 0xf0]
mov qword [rsp + 0x21], 0x10100
mov qword [rsp + 0x29], 0
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
xor r8d, r8d
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xd0], 0
mov qword [rcx + 0xd8], 0
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], 0
and r9d, 0xffffffe0
xor ecx, ecx
mov edx, ecx
add ecx, 0x20
mov qword [rax + rdx], r8
mov qword [rax + rdx + 8], r8
mov qword [rax + rdx + 0x10], r8
mov qword [rax + rdx + 0x18], r8
cmp ecx, r9d
jb 0x42ee95
vmovdqu ymm0, ymmword [0x0073f8e0]
vmovdqu xmm1, xmmword [0x0073f8c0]
vmovdqu xmm2, xmmword [0x0073f8d0]
vpxor ymm0, ymm0, ymmword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0xe4], r10d
vmovdqu xmmword [rbx + 0x20], xmm1
vmovdqu xmmword [rbx + 0x30], xmm2
vmovdqu ymmword [rbx], ymm0
vzeroupper
add rsp, 0x60
pop rbx
ret
mov edx, 0xf0
call fcn.00432090
cmp byte [rbx + 0xe8], 0
je 0x42ef0b
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x42eeea
mov eax, 0xffffffff
jmp 0x42eeea