joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141837466
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rax - 0x263c0000], r11
neg eax
xor dword [rsp + rdi - 0x3a383600], esi
lea rax, [rdi + rdx + 0x4496781f]
mov r10, qword [rsp + rbp - 0xfc80]
neg di
movsxd rsi, esi
sar cx, 0x8c
not qword [rsp + rax - 0x7eceb535]
adc rbx, rsi
mov edx, dword [rax + r8 - 0x7eceb52d]
add edi, ebp
jno 0x1417f8931
mov r11d, 0xc6a2c414
movsx esi, r11b
btr esi, r11d
movzx ecx, byte [rsi + r9 - 0x15]
jb 0x1418133c6
lea rdi, [r11 + 0x74995b9a]
xor cl, r10b
add cl, 0x3e
and rsi, 0x7970c03
xadd r11w, si
xor cl, 0xad
bt r11w, si
mov edx, r11d
ror cl, 1
neg dl
mov eax, 0xd913260e
adc cl, 0xb1
cdqe
shr r11b, 0xa7
xor r10b, cl
dec rax
rol al, 0x64
adc rcx, rsp
not r11
sar ax, 0xad
or esi, eax
mov rdi, qword [rcx + rax + 0x26ecffff]
rol rax, 0x58
bts esi, edx
mov qword [r8 + riz - 8], rdi
neg dx
call fcn.1417a8f81

Function at 0x141837a64
Capabilities:
Encode data using base64

Disassembly:
movsxd r11, r11d
inc qword [rsp + rdx*2 - 0x18828f3a]
add rbx, r11
push rax
mov qword [rsp + rdx - 0xc41479d], rbx
ret 0x10
movsxd r11, r11d
add rbx, r11
idiv rcx
movzx edx, byte [rax + r9 + 0x66c]
movzx r11d, di
lea r9, [rax + r9 + 0x66c]
xor ebp, eax
xor dl, r10b
ror dl, 1
btc rcx, 0x16
shr rsi, 0x46
sub rsi, rdi
inc dl
btr rbp, r11
adc eax, ebp
neg dl
ror sil, 0x85
adc dl, 0x17
rol dl, 1
lea rax, [rdi + 0x3338da36]
shl eax, 0xe1
xor r10b, dl
add rdx, rsp
add eax, ebp
or esi, edi
mov edi, dword [rdx + rsi - 0xd514d6e]
add r11b, 6
mov dword [r8 + rsi*4 - 0x354535c4], edi
mov edi, 0x8ea68634
lea r8, [rsi + r8 - 0xd514d7a]
jnp fcn.1417fa90c
not dl
cwde
shr cl, 0x23
adc dl, 0xa1
neg rcx
ror dl, 1
add dl, 0x3e
imul eax, r11d
inc cl
neg dl
mov qword [rsp + rsi*2], rcx
not dl
inc rdi
sub dl, 0xab
cbw
movsx ebp, ax
not dl
and rsi, 0xffffffff809cda88
add dil, byte [rsp + rsi*2 + 5]
rol dl, 1
neg dl
push r11
xor r10b, dl
or bp, 0x23af
lea rdx, [rsp + rdx + 0x10]
sub qword [rsp + rsi + 4], rsi
shr r11w, 0x82
xor sil, byte [rdx + rcx + 0x6c90571d]
imul edi, r11d
xadd dword [rsp + rax*8 - 0x77fe40], r11d
jg 0x1417991f0
mov word [r8 + rax*2 - 0x1dff94], si
mov rdi, qword [r9 + rax*8 - 0x77fe51]
sal qword [rsp + rcx + 0x6c90571d], 0x29
xor rdi, r10
xor rdi, 0xffffffffe22ef182
ror rdi, 5
mov esi, 0x5e368e3c
lea rdi, [rax + rdi + 0x5ecb0110]
xor rdi, 0xffffffffe89c3c2e
lea rdi, [rdi + rcx + 0x3c9142a]
add byte [rsp + rcx + 0x6c90571e], cl
rol rdi, 3
xor r10, rdi
mov qword [rcx + r8 + 0x6c905713], rdi
mov edi, 0x83254535
mul rcx
mov eax, dword [r9 + rcx + 0x6c905710]
shl r11w, cl
xor eax, r10d
and bp, dx
inc eax
not eax
lea eax, [rcx + rax + 0xbed5e7b]
rol eax, 2
or byte [rsp + rdx - 0xeffba], ch
sbb word [rsp + rcx + 0x6c90572b], bp
mov qword [rsp + rsi - 0x5e368e34], r10
push rsi
xor dword [rsp + rsi - 0x5e368e2c], eax
and dx, r11w
lea r10, [rdi + rsi*4 + 0x40816690]
mov r10, qword [rsp + rdx - 0xe46f8]
call fcn.1417e1b31
jne 0x141808d69
mov qword [rdx + 0x38], rax
call fcn.141837bc3
Function at 0x1400f5965
Capabilities:
Write file on windows

Disassembly:
jmp 0x14016c2c0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e77fa]
call fcn.1400fadde
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14016c318
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14016c42a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14016c3c3
cmp qword [rbp + 0x28], 0
jle 0x14016c3c3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14016c361
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400fa7c6
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14016c419
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14016c419
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400f6072
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1402b62b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e86b4]
call fcn.1400fadde
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jne 0x1402b62ee
mov rcx, qword [rbp + 0x100]
call fcn.1400f6301
nop
jmp 0x1402b630a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x4e0
jb 0x1402b630a
mov rcx, qword [rbp + 0x100]
call fcn.1400f7e4f
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0xb
mov rcx, qword [rbp + 0x100]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 0x12
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1400f6ad6
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1402b6b40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [0x1403c0300]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1403e86b6]
call fcn.1400fadde
nop
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1402b6c11
mov rcx, qword [rbp + 0x120]
call fcn.1400f99b1
movzx eax, al
test eax, eax
je 0x1402b6c11
mov dword [rbp + 8], 1
xor eax, eax
mov word [rbp + 0x12], ax
mov dword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov cx, 0x4e
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rbp + 0x10], ax
mov dword [rbp + 0x14], 0
mov r8d, 0x28
lea rdx, [rbp + 8]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
nop
mov dword [rbp + 0x14], 2
mov r8d, 0x28
lea rdx, [rbp + 8]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140338bf0]
call fcn.1400f9e0c
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400f7d9b
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400f79e5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140174520
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x1403c0300]
xor rax, rbp
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x308], 0
lea rcx, [0x1403e791b]
call fcn.1400fadde
nop
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400f7cdd
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400f894e
nop
mov dword [rbp + 0x284], 0
call fcn.1400fa00a
mov dword [rbp + 0x2a4], eax
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400f58d4
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x140174608
mov qword [rbp + 0x4e0], 0
jmp 0x1401746f3
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x3fffffff
jle 0x140174639
mov qword [rbp + 0x4e8], 0
jmp 0x1401746e5
movsxd rax, dword [rbp + 0x284]
shl rax, 1
mov qword [rbp + 0x4f0], rax
movsxd rcx, dword [rbp + 0x284]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x4f8], rcx
mov rcx, qword [rbp + 0x4f8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x4f8]
ja 0x14017467d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f617b
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x308]
mov rdx, qword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x500]
call fcn.1400fb6cb
add qword [rbp + 0x500], 0x20
mov r9d, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x4f0]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x500]
call fcn.1400f7189
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400fb743
test eax, eax
jne 0x140174735
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x4a4], eax
mov rcx, qword [rbp + 0x538]
call fcn.1400f61b7
mov eax, dword [rbp + 0x4a4]
jmp 0x140174777
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400fa096
test eax, eax
jne 0x1401745d0
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x4c4], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400f61b7
mov eax, dword [rbp + 0x4c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402fee20]
mov r8, qword [rbp + 0x308]
call fcn.1400f8ce1
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.1400f7d9b
lea rsp, [rbp + 0x518]
pop rdi
pop rbp
ret
Function at 0x1400f7e4f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1402b73c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e86b4]
call fcn.1400fadde
nop
mov qword [rbp + 8], 0x26f
mov qword [rbp + 0x28], 0xe3
mov qword [rbp + 0x48], 0
jmp 0x1402b7405
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xe3
jae 0x1402b7496
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
and eax, 1
test eax, eax
je 0x1402b745b
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1402b7465
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0x64]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1402b73fa
mov qword [rbp + 0x88], 0xe3
jmp 0x1402b74b4
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x26f
jae 0x1402b755d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0xa4]
and eax, 1
test eax, eax
je 0x1402b7519
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1402b7523
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xa4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1402b74a3
mov qword [rbp + 0xc8], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xe4]
and eax, 1
test eax, eax
je 0x1402b75bd
mov dword [rbp + 0x1b4], 0x9908b0df
jmp 0x1402b75c7
mov dword [rbp + 0x1b4], 0
mov eax, dword [rbp + 0xe4]
shr eax, 1
xor eax, dword [rbp + 0x1b4]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rbp + 0x1e0]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rbp + 0x1e0]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x1400f84b2
Capabilities:
Terminate process

Disassembly:
jmp 0x1402e23a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400f8c14
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401a8600
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e7c14]
call fcn.1400fadde
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400f8c9b
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402dd300
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1402dd33d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400fada7
add rsp, 0x58
ret

Function at 0x1400f8f20
Capabilities:
Read file on windows

Disassembly:
jmp 0x1401a8580
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e7c14]
call fcn.1400fadde
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400f8f3e
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401aa3b0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e7c14]
call fcn.1400fadde
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402ff610]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1401aa4f6
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1401aa44a
mov dword [rbp + 0x160], 1
jmp 0x1401aa454
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1401aa4f1
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1401aa4cb
cmp qword [rbp + 0x198], 2
jb 0x1401aa4cb
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aa4cb
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aa4cb
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401aa415
jmp 0x1401aa590
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1401aa590
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1401aa567
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aa567
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401aa567
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1401aa4f6
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400f917d
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402e3c30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402e3c50
xor al, al
jmp 0x1402e3cd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402e3c63
xor al, al
jmp 0x1402e3cd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402e3c8d
xor al, al
jmp 0x1402e3cd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402e3ca1
xor al, al
jmp 0x1402e3cd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402e3cb3
xor al, al
jmp 0x1402e3cd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402e3ccf
xor al, al
jmp 0x1402e3cd1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400fa078
Capabilities:
Create directory

Disassembly:
jmp 0x1402de8e0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1403c0300]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402de91d
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1402de992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1402de980
mov edx, 1
mov ecx, 2
call fcn.1400f53a7
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400f6b2b
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402de980
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.1400f5bbd
movzx eax, al
test eax, eax
jne 0x1402de980
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f7d9b
add rsp, 0x68
ret
Function at 0x1400fa6a4
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401aa290
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1403e7c14]
call fcn.1400fadde
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402ff610]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1401aa310
mov dword [rbp + 0x120], 1
jmp 0x1401aa31a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1401aa363
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1401aa2db
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400fa749
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140165100
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x1403c0300]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x1403e759e]
call fcn.1400fadde
nop
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400f7cdd
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400f8aa7
nop
mov dword [rbp + 0x484], 0
call fcn.1400fa00a
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f58d4
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x1401651f0
mov qword [rbp + 0x7a0], 0
jmp 0x1401652db
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x140165221
mov qword [rbp + 0x7a8], 0
jmp 0x1401652cd
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x140165265
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f617b
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400fb6cb
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400f7189
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400fb743
test eax, eax
jne 0x140165320
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f61b7
mov rax, qword [rbp + 0x768]
jmp 0x140165364
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400f5e83
test eax, eax
jne 0x1401651b8
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f61b7
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402fda90]
mov r8, qword [rbp + 0x508]
call fcn.1400f8ce1
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400f7d9b
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret