joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64d0c880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x64d0c950
jb 0x64d0c9af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 1
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 2
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 2
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 4
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 4
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 8
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 8
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 0x10
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 0x10
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 0x20
call fcn.64d0c760
aeskeygenassist xmm1, xmm0, 0x20
call fcn.64d0c780
aeskeygenassist xmm1, xmm2, 0x40
call fcn.64d0c760
jmp 0x64d0ca1d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.64d0c6c0
aeskeygenassist xmm1, xmm2, 2
call fcn.64d0c720
aeskeygenassist xmm1, xmm2, 4
call fcn.64d0c6c0
aeskeygenassist xmm1, xmm2, 8
call fcn.64d0c720
aeskeygenassist xmm1, xmm2, 0x10
call fcn.64d0c6c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.64d0c720
aeskeygenassist xmm1, xmm2, 0x40
call fcn.64d0c6c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.64d0c720
jmp 0x64d0ca1d
aeskeygenassist xmm1, xmm0, 1
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 2
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 4
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 8
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x10
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x20
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x40
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x80
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.64d0c680
aeskeygenassist xmm1, xmm0, 0x36
call fcn.64d0c680
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x64d0ca2a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x64d5a650
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x40
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsxd rdx, dword [rax + 0x3c]
mov ebx, dword [rdx + rax + 0x28]
mov edx, 0xffffe0ff
lea rdi, [rsp + 0x20]
mov word [rsp + 0x2e], dx
mov edx, 0xc
add rbx, rax
mov eax, 0xffffb848
mov r9, rdi
mov word [rsp + 0x24], ax
mov rax, qword [sym.vspmsg.dll_test]
mov rcx, rbx
mov qword [rsp + 0x26], rax
call rsi
lea r8, [rsp + 0x24]
lea r9, [rbx + 0xc]
mov rdx, rbx
mov ecx, 0x48
sub r8, rbx
jmp 0x64d5a6c5
movzx ecx, byte [r8 + rdx]
mov byte [rdx], cl
add rdx, 1
cmp r9, rdx
jne 0x64d5a6c0
mov r8d, dword [rsp + 0x20]
mov r9, rdi
mov edx, 0xc
mov rcx, rbx
call rsi
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x64d5a750
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x64eb6830], rax
test rax, rax
je 0x64d5a785
lea rcx, [0x64eb6840]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [fcn.64d5c2a0]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
Function at 0x64d5aee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x64eb6e44]
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
test esi, esi
jle 0x64d5b094
mov rax, qword [0x64eb6e48]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x64d5af2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x64d5afb9
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x64d5af10
mov rcx, rbx
call fcn.64d5bbb0
test rax, rax
mov r12, rax
je 0x64d5b0c9
mov rax, qword [0x64eb6e48]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.64d5bce0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x64eb6e48]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x64d5b0ac
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x64d5afb2
sub eax, 0x40
and eax, 0xffffffbf
jne 0x64d5b034
add dword [0x64eb6e44], 1
cmp edi, 8
jae 0x64d5aff0
test dil, 4
jne 0x64d5b080
test edi, edi
je 0x64d5afdc
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x64d5b09b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp]
mov qword [rbx], rax
mov eax, edi
mov rdx, qword [rbp + rax - 8]
mov qword [rbx + rax - 8], rdx
lea rax, [rbx + 8]
and rax, 0xfffffffffffffff8
sub rbx, rax
sub rbp, rbx
add ebx, edi
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x64d5afdc
and ebx, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r8, qword [rbp + rcx]
cmp edx, ebx
mov qword [rax + rcx], r8
jb 0x64d5b020
jmp 0x64d5afdc
add rsi, qword [0x64eb6e48]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x64d5afb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.64d5c2e0
nop dword [rax + rax]
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x64d5afdc
xor esi, esi
jmp 0x64d5af37
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x64d5afdc
mov rax, qword [0x64eb6e48]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rsi + 0x18]
call fcn.64d5c2e0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.64d5c2e0
nop
nop dword [rax]
Function at 0x64d5b820
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x64eb7120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x64eb7100]
test rbx, rbx
je 0x64d5b874
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x64d5b86b
test rsi, rsi
je 0x64d5b86b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x64d5b850
lea rcx, [0x64eb7120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x64d5bbb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x64e588d0]
mov rdx, rcx
cmp word [r8], 0x5a4d
jne 0x64d5bc1d
mov rcx, r8
call fcn.64d5ba90
test eax, eax
je 0x64d5bc1d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x64d5bc1d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x64d5bc14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x64d5bc1f
add rax, 0x28
cmp rax, r9
jne 0x64d5bc00
xor eax, eax
add rsp, 0x28
ret

Function at 0x64d5c2e0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x64c813a0]
jmp 0x64c81380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.64d5c2a0
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
mov r8d, 0x1b
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.64d5c2a0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x64c81390
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
push rsi
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021