joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068240
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov eax, 0xffffffff
cmp dword [rcx + 0x60], 0
jne 0x140068301
mov rsi, rcx
xor eax, eax
cmp dword [rcx + 0x3c], 0
jne 0x140068301
mov edi, dword [rsi + 0x14]
mov rbx, qword [rsi + 0x20]
mov dword [rsi + 0x78], 0
xor r9d, r9d
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
nop
mov ecx, dword [rsi + 4]
mov edx, r9d
add rdx, rbx
mov r8d, edi
sub r8d, r9d
call r14
test eax, eax
jle 0x1400682c7
mov edx, dword [rsi + 0x78]
add edx, eax
mov dword [rsi + 0x78], edx
mov r8d, edi
sub r8d, edx
jbe 0x1400682d2
mov ecx, dword [rsi + 4]
mov edx, edx
add rdx, rbx
call r14
test eax, eax
jle 0x1400682c7
mov r9d, dword [rsi + 0x78]
add r9d, eax
mov dword [rsi + 0x78], r9d
cmp r9d, edi
jb 0x140068280
jmp 0x1400682d2
test eax, eax
js 0x1400682de
mov dword [rsi + 0x3c], 1
mov rax, qword [rsi + 0x20]
mov qword [rsi + 0x70], rax
xor eax, eax
jmp 0x140068301
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rcx, rsi
mov edx, 0xffffffff
mov r8, rax
call fcn.140056740
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140077450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov rbx, rdx
mov r13, rcx
movzx eax, byte [r9 + 8]
test al, 0xef
jne 0x14007757f
lea rax, [0x140123aa7]
lea r14, [0x140123aac]
test r8b, r8b
cmovne r14, rax
movzx esi, r8b
xor rsi, 5
mov eax, dword [rdi]
xor r12d, r12d
sub rax, rsi
cmovae r12, rax
movzx eax, byte [rdi + 9]
and eax, 0xf
lea rcx, [0x14013e29a]
movzx ecx, byte [rax + rcx]
mov r15, r12
shr r15, cl
add rdi, 0xb
test r15, r15
mov qword [rsp + 0x38], r13
je 0x1400774dd
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, r15
mov r9, rdi
call fcn.140079a90
mov rbx, qword [rsp + 0x30]
mov rax, r12
sub rax, r15
mov qword [rsp + 0x40], rax
add rsi, r14
mov rcx, qword [rbx + 0x10]
jmp 0x14007750f
add rcx, r13
mov qword [rbx + 0x10], rcx
add r14, r13
cmp r14, rsi
je 0x140077556
mov rbp, rsi
sub rbp, r14
lea rdx, [rcx + rbp]
mov r13, qword [rbx + 0x18]
cmp r13, rdx
jae 0x140077532
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, qword [rbx + 0x10]
mov r13, qword [rbx + 0x18]
sub r13, rcx
cmp r13, rbp
cmovae r13, rbp
test r13, r13
je 0x140077500
add rcx, qword [rbx + 8]
mov rdx, r14
mov r8, r13
call fcn.1400adb90
mov rcx, qword [rbx + 0x10]
jmp 0x140077500
cmp r12, r15
je 0x140077575
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, qword [rsp + 0x40]
mov r9, rdi
call fcn.140079a90
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rax], rbx
jmp 0x1400775b9
movzx eax, byte [rdi + 9]
shr rax, 2
and eax, 0x1c
lea rcx, [0x14013eb90]
mov eax, dword [rax + rcx]
shl rax, 0x20
movzx r8d, r8b
or r8, rax
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, rbx
mov r9, rdi
call fcn.1400775d0
mov rax, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140099770
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400997cb
mov rdi, qword [rsi + 0x20]
lea rax, [rdi - 1]
cmp qword [rsi + 0x18], rax
jb 0x1400997f6
lea rdx, [rdi*8 + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rsi + 0x28], rax
test rax, rax
je 0x1400997fd
add rdi, 8
mov rcx, qword [rsi + 0x20]
xorps xmm0, xmm0
movups xmmword [rax + rcx*8 + 0x30], xmm0
movups xmmword [rax + rcx*8 + 0x20], xmm0
movups xmmword [rax + rcx*8 + 0x10], xmm0
movups xmmword [rax + rcx*8], xmm0
mov qword [rsi + 0x20], rdi
jmp 0x1400997f6
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0x28], rax
test rax, rax
je 0x1400997fd
mov qword [rax], 0
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x18], 0
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x140141116]
lea r8, str.out_of_dynamic_memory_in_osoensure_buffer_stack__
mov rcx, rax
call fcn.140008d40
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140099830
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov rdi, rcx
mov ecx, 0x40
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14009990a
mov rsi, rax
mov dword [rax + 0x18], ebp
add ebp, 2
movsxd rcx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 8], rax
test rax, rax
je 0x14009990a
mov r14, rax
mov dword [rsi + 0x20], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebp, dword [rax]
mov dword [rsi + 0x1c], 0
mov word [r14], 0
mov qword [rsi + 0x10], r14
mov dword [rsi + 0x28], 1
mov dword [rsi + 0x38], 0
mov rax, qword [rbx + 0x28]
test rax, rax
je 0x1400998d4
mov rcx, qword [rbx + 0x18]
mov rax, qword [rax + rcx*8]
cmp rax, rsi
jne 0x1400998d6
mov dword [rbx + 0x34], 0
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x80], r14
mov byte [rbx + 0x30], 0
jmp 0x1400998d6
xor eax, eax
mov qword [rsi], rdi
mov dword [rsi + 0x34], 1
cmp rax, rsi
je 0x1400998ed
mov qword [rsi + 0x2c], 1
mov dword [rsi + 0x24], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], ebp
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x140141116]
lea r8, str.out_of_dynamic_memory_in_oso_create_buffer__
mov rcx, rax
call fcn.140008d40
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140099d70
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp rdx, 2
jb 0x140099d94
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + rdx - 2], 0
jne 0x140099d94
cmp byte [r14 + rbx - 1], 0
je 0x140099da3
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, r8
mov ecx, 0x40
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140099e6c
mov rsi, rax
add r14, 0xfffffffffffffffe
mov dword [rax + 0x18], r14d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], 0
mov qword [rax], 0
mov dword [rax + 0x1c], r14d
movabs rax, 0x100000000
mov qword [rsi + 0x24], rax
mov qword [rsi + 0x34], 0
mov rcx, rdi
call fcn.140099770
mov rax, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rcx + rax*8]
cmp rdx, rsi
je 0x140099d96
test rdx, rdx
je 0x140099e40
movzx eax, byte [rdi + 0x30]
mov rcx, qword [rdi + 0x40]
mov byte [rcx], al
mov rdx, qword [rdi + 0x40]
mov rax, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov r8, qword [rcx + rax*8]
mov qword [r8 + 0x10], rdx
mov edx, dword [rdi + 0x34]
mov dword [r8 + 0x1c], edx
mov r14d, dword [rsi + 0x1c]
mov rbx, qword [rsi + 0x10]
mov qword [rcx + rax*8], rsi
mov dword [rdi + 0x34], r14d
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x80], rbx
mov rax, qword [rsi]
mov qword [rdi + 8], rax
movzx eax, byte [rbx]
mov byte [rdi + 0x30], al
mov dword [rdi + 0x50], 1
jmp 0x140099d96
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x140141116]
lea r8, str.out_of_dynamic_memory_in_oso_scan_buffer__
mov rcx, rax
call fcn.140008d40
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140099ed0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov ebx, edx
mov r15, rcx
lea eax, [rbx + 2]
movsxd rdi, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140099f3c
mov r14, rax
test ebx, ebx
jle 0x140099f0c
mov r8d, ebx
mov rcx, r14
mov rdx, r15
call fcn.1400adb90
movsxd rax, ebx
mov word [r14 + rax], 0
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call fcn.140099d70
test rax, rax
je 0x140099f57
mov dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x140141116]
lea r8, str.out_of_dynamic_memory_in_oso_scan_bytes__
jmp 0x140099f70
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x140141116]
lea r8, str.bad_buffer_in_oso_scan_bytes__
mov rcx, rax
call fcn.140008d40
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400adf80
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
xor ecx, ecx
call fcn.1400adc40
lea rcx, [0x1401fb070]
mov edx, 6
call fcn.1400af6e0
cmp eax, 1
jne 0x1400adfb2
xor ecx, ecx
mov edx, esi
add rsp, 0x20
pop rsi
jmp 0x1400b2fc0
test eax, eax
js 0x1400adfbc
add rsp, 0x20
pop rsi
ret
mov ecx, 1
xor edx, edx
xor r8d, r8d
call fcn.1400b2f20
mov ecx, 1
mov edx, 0x3a
xor r8d, r8d
call fcn.1400b2f20
mov ecx, 1
xor edx, edx
xor r8d, r8d
call fcn.1400b2f20
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
push rsi
push rdi
push rbx
sub rsp, 0x250
mov esi, edx
mov rax, qword [0x1401af968]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov ebx, edx
and ebx, 4
mov edi, edx
and edi, 2
je 0x1400b2ff1
mov eax, ecx
and eax, 2
je 0x1400b3001
xor eax, eax
test ebx, ebx
je 0x1400b302e
mov eax, 1
test cl, 4
jne 0x1400b302e
lea rcx, [rsp + 0x40]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
fxsave [rsp + 0x40]
mov eax, dword [rsp + 0x5c]
mov ecx, eax
shl ecx, 0x19
sar ecx, 0x1f
and edi, ecx
shl eax, 0xe
sar eax, 0x1f
and eax, ebx
test sil, 1
je 0x1400b304b
stmxcsr dword [rsp + 0x3c]
mov ecx, 0x8000
or ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], ecx
ldmxcsr dword [rsp + 0x38]
test edi, edi
je 0x1400b3064
stmxcsr dword [rsp + 0x34]
mov ecx, dword [rsp + 0x34]
or ecx, 0x40
mov dword [rsp + 0x30], ecx
ldmxcsr dword [rsp + 0x30]
test eax, eax
je 0x1400b307f
stmxcsr dword [rsp + 0x2c]
mov eax, 0x20000
or eax, dword [rsp + 0x2c]
mov dword [rsp + 0x28], eax
ldmxcsr dword [rsp + 0x28]
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401185a0
nop
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400af790
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
xor esi, esi
test rcx, rcx
je 0x1400af8e0
mov rdi, rcx
lea rcx, str.INTEL_ISA_DISABLE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400af8e0
mov rdx, rax
movzx eax, byte [rax]
xor esi, esi
test al, al
je 0x1400af8e0
lea r8, [0x1401fb0a0]
xor r9d, r9d
mov rcx, rdx
inc rdx
mov r10d, 1
xor r11d, r11d
cmp al, 0x2c
jne 0x1400af803
nop
movzx eax, byte [rcx + r11 + 1]
inc r11
dec r10
inc rdx
cmp al, 0x2c
je 0x1400af7f0
movzx eax, al
test eax, eax
je 0x1400af8e0
nop
mov rax, rdx
movzx ebx, byte [rdx]
inc rdx
cmp ebx, 0x2c
je 0x1400af830
test ebx, ebx
je 0x1400af830
mov r9, rax
jmp 0x1400af810
mov rax, r9
sub rax, rcx
inc rax
dec rdx
cmp rax, r11
jne 0x1400af84d
movzx eax, byte [rdx]
test al, al
jne 0x1400af7db
jmp 0x1400af8e0
cmp byte [0x1401fb090], 0
jne 0x1400af85b
call fcn.1400aec40
mov rax, rcx
neg rax
lea rbx, [rcx + r11]
sub rcx, r9
add r11, rcx
dec r11
mov ecx, 1
jmp 0x1400af889
inc rcx
cmp rcx, 0x47
je 0x1400af841
lea r14, [rcx + rcx*2]
mov r14, qword [r8 + r14*8 + 0x10]
test r14, r14
je 0x1400af880
xor r15d, r15d
nop word [rax + rax]
movzx ebp, byte [rbx + r15]
cmp bpl, byte [r14 + r15]
jne 0x1400af880
inc r15
mov r12, r11
add r12, r15
jne 0x1400af8a0
add r14, r9
add r14, rax
cmp byte [r10 + r14], 0
jne 0x1400af880
cmp ecx, 2
jb 0x1400af841
mov rax, rdi
call fcn.1400af730
cmp eax, 1
adc rsi, 0
jmp 0x1400af841
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400defa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1400df1b6
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400df064
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400df020
mov ecx, dword [r10]
jmp 0x1400df147
cmp ecx, 0x4e0
jb 0x1400df147
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400df080
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400df0d0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x1400df000
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x1400deff0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400df1da
cmp r8, r14
jne 0x1400defd0
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400e5020
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400e50c4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400e5080
mov ecx, dword [r10]
jmp 0x1400e51a7
cmp ecx, 0x4e0
jb 0x1400e51a7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e50e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400e5130
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400e5060
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400e5050
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret

Function at 0x1400e9dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400e9df4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400e9de0
ret
Function at 0x1400ef620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x58]
mov rdi, r8
mov rax, rdx
mov rbx, rcx
test r9, r9
je 0x1400ef71e
test r8, r8
je 0x1400ef71e
cmp dword [rcx + 0x30], 0x72
jne 0x1400ef71e
mov edx, 1
mov qword [rsp + 0x40], rsi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rbx + 0x28], rax
mov rsi, rax
cmp rax, rdi
jae 0x1400ef70b
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x1400ef69b
lea rax, str.end_of_file
mov qword [rsp + 0x28], 0xb
mov qword [rsp + 0x20], rax
jmp 0x1400ef6fe
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400ef70b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
test ecx, ecx
je 0x1400ef6d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
test rax, rax
lea rcx, str.unknown_error
cmovne rcx, rax
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x1400ef6e3
xor eax, eax
jmp 0x1400ef6f9
lea rcx, str.unknown_error
mov qword [rsp + 0x20], rcx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ef6f0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400eab40
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400f4d90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 0x58]
mov rax, rdx
mov rbx, rcx
test r9, r9
je 0x1400f4dd6
test r8, r8
je 0x1400f4dd6
cmp dword [rcx + 0x30], 0x77
jne 0x1400f4dd6
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add qword [rbx + 0x28], rax
mov rcx, qword [rbx + 0x28]
cmp rcx, qword [rbx + 0x60]
jle 0x1400f4dd8
mov qword [rbx + 0x60], rcx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400f8000
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401af968]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r8, qword [rdx + 8]
mov rdi, rcx
mov rdx, qword [rdx]
lea rcx, [rsp + 0x20]
xor ebx, ebx
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rbx
call fcn.140008e70
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, qword [rsp + 0x38]
mov rsi, rax
cmp rdx, 0x10
jb 0x1400f80a1
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f809c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f809c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140117b2c
test rsi, rsi
mov qword [rsp + 0x30], rbx
lea rax, [0x140143029]
mov qword [rsp + 0x38], 0xf
cmovne rax, rsi
mov byte [rsp + 0x20], bl
mov qword [rdi], rax
test rax, rax
je 0x1400f80d9
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400f80d0
mov qword [rdi + 8], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401185a0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fd6a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor r14d, r14d
mov qword [rbp - 0x10], r14
lea r8, [rbp + 0x38]
mov edx, 0x200
lea rcx, [rbp - 0x20]
call fcn.1400f9ba0
mov edi, r14d
nop word [rax + rax]
mov rcx, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x20]
test edi, edi
je 0x1400fd74f
mov r8, rcx
sub r8, rbx
sar r8, 3
lea rdx, [r8 + r8]
cmp rdx, r8
jae 0x1400fd709
lea rcx, [rbx + rdx*8]
mov qword [rbp - 0x18], rcx
jmp 0x1400fd74f
jbe 0x1400fd74f
mov rax, qword [rbp - 0x10]
sub rax, rbx
sar rax, 3
cmp rdx, rax
jbe 0x1400fd72e
lea r8, [rbp + 0x38]
lea rcx, [rbp - 0x20]
call fcn.1400f9ba0
mov rcx, qword [rbp - 0x18]
jmp 0x1400fd74b
sub rdx, r8
lea r8, [rdx*8]
lea rbx, [r8 + rcx]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov qword [rbp - 0x18], rbx
mov rbx, qword [rbp - 0x20]
sub rcx, rbx
sar rcx, 3
lea esi, [rcx*8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rbp + 0x40]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400fd82c
mov eax, dword [rbp + 0x40]
cmp eax, esi
jbe 0x1400fd795
inc edi
cmp edi, 3
jl 0x1400fd6e0
mov rdi, qword [rbp - 0x18]
jmp 0x1400fd805
mov rcx, rax
shr rcx, 3
mov rdi, qword [rbp - 0x18]
mov rdx, rdi
mov rbx, qword [rbp - 0x20]
sub rdx, rbx
sar rdx, 3
cmp rcx, rdx
jae 0x1400fd7bd
lea rdi, [rbx + rcx*8]
mov qword [rbp - 0x18], rdi
jmp 0x1400fd809
jbe 0x1400fd809
mov rax, qword [rbp - 0x10]
sub rax, rbx
sar rax, 3
cmp rcx, rax
jbe 0x1400fd7e5
lea r8, [rbp + 0x38]
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.1400f9ba0
mov rdi, qword [rbp - 0x18]
jmp 0x1400fd805
sub rcx, rdx
lea r8, [rcx*8]
lea rbx, [r8 + rdi]
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rdi, rbx
mov qword [rbp - 0x18], rbx
mov rbx, qword [rbp - 0x20]
cmp rbx, rdi
je 0x1400fd836
nop
mov rdx, r15
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400fd82f
add rbx, 8
cmp rbx, rdi
jne 0x1400fd810
jmp 0x1400fd832
mov rax, r14
mov r14, rax
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x1400fd876
mov rdx, qword [rbp - 0x10]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400fd86e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd86e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140117b2c
mov rax, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret