joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10a9608
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.010aebcc
nop
cmp dword [0x010dad34], 1
je 0x10a96bb
mov dword [0x010dad30], 1
mov byte [0x010dacec], dil
test ebx, ebx
jne 0x10a96a7
mov rcx, qword [0x010e6650]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x010e6648]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x10a9694
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x10a9694
mov rcx, qword [rbx]
test rcx, rcx
je 0x10a9692
call rcx
jmp 0x10a967a
lea rdx, [0x01001670]
lea rcx, [0x01001658]
call fcn.010a946c
lea rdx, [0x01001680]
lea rcx, [0x01001678]
call fcn.010a946c
nop
test edi, edi
je 0x10a96c9
mov ecx, 8
call fcn.010aea98
test edi, edi
jne 0x10a96f1
mov dword [0x010dad34], 1
lea ecx, [rdi + 8]
call fcn.010aea98
mov ecx, r12d
call fcn.010a93f0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10a9608

Function at 0x10a9730
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.010aebcc
nop
cmp dword [0x010dad34], 1
je 0x10a96bb
mov dword [0x010dad30], 1
mov byte [0x010dacec], dil
test ebx, ebx
jne 0x10a96a7
mov rcx, qword [0x010e6650]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x010e6648]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x10a9694
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x10a9694
mov rcx, qword [rbx]
test rcx, rcx
je 0x10a9692
call rcx
jmp 0x10a967a
lea rdx, [0x01001670]
lea rcx, [0x01001658]
call fcn.010a946c
lea rdx, [0x01001680]
lea rcx, [0x01001678]
call fcn.010a946c
nop
test edi, edi
je 0x10a96c9
mov ecx, 8
call fcn.010aea98
test edi, edi
jne 0x10a96f1
mov dword [0x010dad34], 1
lea ecx, [rdi + 8]
call fcn.010aea98
mov ecx, r12d
call fcn.010a93f0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10a9608

Function at 0x10a9740
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x10a9608
Function at 0x10a97e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x010d71c0]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x10a9813
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x10a9803
cmp edi, 0x17
jae 0x10a99c1
mov ebp, 3
mov ecx, ebp
call fcn.010b0b28
cmp eax, 1
je 0x10a9979
mov ecx, ebp
call fcn.010b0b28
test eax, eax
jne 0x10a9849
cmp dword [0x010d7198], 1
je 0x10a9979
cmp ebx, 0xfc
je 0x10a99c1
lea rbx, [0x010dad40]
mov ebp, 0x314
lea r8, [0x01001fa0]
mov rcx, rbx
mov rdx, rbp
call fcn.010adbd4
test eax, eax
je 0x10a988c
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
lea rdx, [0x010dad59]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x010dae5d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10a98dd
lea r8, [0x01001f88]
lea rcx, [0x010dad59]
mov edx, 0x2fb
call fcn.010adbd4
test eax, eax
je 0x10a98dd
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
lea r8, [0x010dad59]
mov rdx, rbp
mov rcx, rbx
call fcn.010b0a94
test eax, eax
je 0x10a9908
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
lea r8, [0x01001f80]
mov rdx, rbp
mov rcx, rbx
call fcn.010b0a94
test eax, eax
je 0x10a9933
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.010b0a94
test eax, eax
je 0x10a9962
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
lea rdx, [0x01001f58]
mov r8d, 0x12010
mov rcx, rbx
call fcn.010b0860
jmp 0x10a99c1
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x10a99c1
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x10a99c1
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret

Function at 0x10aa064
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x10aa08c
xor eax, eax
jmp 0x10aa0d8
cmp word [rdi], bx
je 0x10aa0a3
add rax, 2
cmp word [rax], bx
jne 0x10aa091
add rax, 2
cmp word [rax], bx
jne 0x10aa091
sub eax, edi
add eax, 2
movsxd rbp, eax
mov rcx, rbp
call fcn.010a7648
cmp rax, rbx
mov rsi, rax
je 0x10aa0cc
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.010ac860
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10aa8a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10aa8f2
cmp rcx, 0xffffffffffffffff
je 0x10aa8f2
cmp word [rcx], 0x5a4d
jne 0x10aa8ea
cmp dword [rcx + 0x3c], edx
jl 0x10aa8ea
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10aa8ea
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10aa8f2
mov rax, rdx
add rsp, 0x18
ret

Function at 0x10aaaaf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x010d71a0]
jne 0x10a6eaa
rol rcx, 0x10
test cx, 0xffff
jne 0x10a6ea6
repz ret
ror rcx, 0x10
jmp 0x10aaa08
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x010db320]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x010db418]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10aaa8d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x010db320]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10aaaaf
mov rax, qword [rsp + 0x88]
mov qword [0x010db418], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x010db3b8], rax
mov rax, qword [0x010db418]
mov qword [0x010db290], rax
mov rax, qword [rsp + 0x90]
mov qword [0x010db3a0], rax
mov dword [0x010db280], 0xc0000409
mov dword [0x010db284], 1
mov rax, qword [0x010d71a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x010d71a8]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01001fc0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10aab30
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10aab9b
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x10aabbb
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01001fd0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x10b0860
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.010aa3dc
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
cmp qword [0x010dbaa8], rbp
mov rdi, rax
jne 0x10b0993
lea rcx, [0x010021b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rsi, rax
jne 0x10b08bf
xor eax, eax
jmp 0x10b0a73
lea rdx, [0x010021a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10b08b8
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01002190]
mov rcx, rsi
mov qword [0x010dbaa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x01002178]
mov rcx, rsi
mov qword [0x010dbab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x010dbab8], rax
call fcn.010a94a8
test eax, eax
je 0x10b0946
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
cmp dword [rsp + 0x88], 2
jne 0x10b0993
lea rdx, [0x01002158]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
test rax, rax
mov qword [0x010dbac8], rax
je 0x10b0993
lea rdx, [0x01002140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x010dbac0], rax
mov rcx, qword [0x010dbac0]
cmp rcx, rdi
je 0x10b0a25
cmp qword [0x010dbac8], rdi
je 0x10b0a25
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rsi, rax
je 0x10b09f0
mov rcx, qword [0x010dbac8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x10b09f0
test byte [rsp + 0x40], 1
jne 0x10b0a25
lea rcx, [rsp + 0x30]
call fcn.010a94f4
test eax, eax
je 0x10b0a12
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.010aab30
cmp dword [rsp + 0x30], 4
jb 0x10b0a1f
bts ebx, 0x15
jmp 0x10b0a59
bts ebx, 0x12
jmp 0x10b0a59
mov rcx, qword [0x010dbab0]
cmp rcx, rdi
je 0x10b0a59
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rbp, rax
je 0x10b0a59
mov rcx, qword [0x010dbab8]
cmp rcx, rdi
je 0x10b0a59
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x010dbaa8]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x10c8a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
xor ebx, ebx
test r8d, r8d
mov qword [rsp + 0x18], rsi
mov r9, rdx
mov rsi, rcx
je 0x10c8acd
mov qword [rsp + 0x20], rdi
mov edi, r8d
nop
nop
nop
nop
mov r11b, byte [r9]
shr r11d, 4
and r11d, 0xf
xor r10d, r10d
movsxd rax, r11d
lea r8, [rsi + rax*8 + 4]
cmp r11d, 0xa
jae 0x10c8aae
movzx edx, word [r9]
mov ecx, r10d
mov eax, pe_nt_image_headers64
shl eax, cl
test edx, eax
je 0x10c8aae
xor dl, byte [r8 - 4]
test dl, 0xf
jne 0x10c8a9a
movzx eax, word [r8 - 2]
cmp word [r9 + 2], ax
jne 0x10c8a9a
movzx eax, word [r8]
cmp word [r9 + 4], ax
jne 0x10c8a9a
movzx eax, word [r8 + 2]
cmp word [r9 + 6], ax
je 0x10c8aae
mov rax, qword [r9]
lea ecx, [r10 + r11*2]
mov edx, 1
shl edx, cl
mov qword [r8 - 4], rax
or ebx, edx
inc r10d
add r8, 0x50
cmp r10d, 2
jb 0x10c8a56
add r9, 8
dec rdi
jne 0x10c8a40
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x10]
ret
Function at 0x142134998
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1421349a2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1421349cb
pop rbp
sub rbp, 0x33
sub rbp, 0x2134998
sub rsp, 0x20
jmp 0x1421349ea
mov rax, 0x2134998
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb17de3ea
xor byte [rax], dl
inc rax
dec rcx
jne 0x142134a09
jmp 0x142134a20
movabs byte [0xeaeaead663610363], al
movabs byte [0xeba2eaeaebe22b6b], al
add esp, dword [rdx - 0x151cd5d3]
invalid

Function at 0x140761108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14076128f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140761139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076111f
add dl, dl
jne 0x140761146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407611a6
xor eax, eax
add dl, dl
jne 0x140761155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076125d
add dl, dl
jne 0x140761166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140761173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140761180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14076118d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14076119a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14076112e
mov eax, 1
add dl, dl
jne 0x1407611b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407611c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407611ab
sub eax, ebx
mov ebx, 1
jne 0x1407611fc
mov ecx, 1
add dl, dl
jne 0x1407611de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407611eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407611d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076112e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140761218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140761225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076120d
cmp eax, 0x7d00
jae 0x14076124b
cmp eax, 0x500
jb 0x140761246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076112e
cmp eax, 0x7f
ja 0x14076124e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076112e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140761282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14076112e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140042735
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
jmp 0x140061b10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2f8]
mov rax, qword [0x1400fe028]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x14011523d]
call fcn.1400459e4
mov rdx, qword [rbp + 0x2b0]
lea rcx, [rbp + 8]
call fcn.1400427f3
nop
mov edx, 0x20
lea rcx, [rbp + 0x48]
call fcn.140042343
lea rcx, [rbp + 0x48]
call fcn.1400447ba
nop
mov dword [rbp + 0x84], 0
lea rcx, [rbp + 8]
call fcn.14004258c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x84]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140061c02
mov qword [rbp + 0x1e8], 0
lea rcx, [rbp + 0x48]
call fcn.14004320c
nop
lea rcx, [rbp + 8]
call fcn.140042afa
nop
mov rcx, qword [rbp + 0x2b0]
call fcn.140042afa
mov rax, qword [rbp + 0x1e8]
jmp 0x140061da9
mov eax, dword [rbp + 0x84]
mov edx, eax
lea rcx, [rbp + 0x48]
call fcn.140043dc9
lea rcx, [rbp + 0x48]
call fcn.140045f16
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 8]
call fcn.14004258c
mov qword [rbp + 0x280], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x278]
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x280]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140061ca8
mov qword [rbp + 0x208], 0
lea rcx, [rbp + 0x48]
call fcn.14004320c
nop
lea rcx, [rbp + 8]
call fcn.140042afa
nop
mov rcx, qword [rbp + 0x2b0]
call fcn.140042afa
mov rax, qword [rbp + 0x208]
jmp 0x140061da9
lea rcx, [rbp + 0x48]
call fcn.140045f16
add rax, 5
mov qword [rbp + 0xb0], rax
mov eax, dword [rbp + 0x84]
sub eax, 5
mov dword [rbp + 0xa8], eax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xa8]
call fcn.140045610
test eax, eax
jne 0x140061d34
mov qword [rbp + 0x228], 0
lea rcx, [rbp + 0x48]
call fcn.14004320c
nop
lea rcx, [rbp + 8]
call fcn.140042afa
nop
mov rcx, qword [rbp + 0x2b0]
call fcn.140042afa
mov rax, qword [rbp + 0x228]
jmp 0x140061da9
mov ecx, 0x10
call fcn.14004228f
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0xe0]
mov qword [rax + 8], rcx
mov rax, qword [rbp + 0x108]
mov ecx, dword [rbp + 0xd8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x268], rax
lea rcx, [rbp + 0x48]
call fcn.14004320c
nop
lea rcx, [rbp + 8]
call fcn.140042afa
nop
mov rcx, qword [rbp + 0x2b0]
call fcn.140042afa
mov rax, qword [rbp + 0x268]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400d6c30]
call fcn.140045020
mov rax, rdi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.140043bb2
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x140042a3c
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140095110
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x140095139
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140095183
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14009512e
mov rax, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140044049
Capabilities:
Terminate process

Disassembly:
jmp 0x1400c2640
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14004483c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400c47a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400c47c0
xor al, al
jmp 0x1400c4841
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400c47d3
xor al, al
jmp 0x1400c4841
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400c47fd
xor al, al
jmp 0x1400c4841
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400c4811
xor al, al
jmp 0x1400c4841
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400c4823
xor al, al
jmp 0x1400c4841
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400c483f
xor al, al
jmp 0x1400c4841
mov al, 1
add rsp, 0x38
ret
Function at 0x14004575a
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x1400613a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1400fe028]
xor rax, rbp
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x184], 0
lea rcx, [0x1401151ce]
call fcn.1400459e4
mov rcx, qword [rbp + 0x1c8]
call fcn.14004258c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14006146d
lea rdx, [0x1400d8108]
mov rcx, qword [rbp + 0x1c0]
call fcn.140043a22
mov eax, dword [rbp + 0x184]
or eax, 1
mov dword [rbp + 0x184], eax
mov rax, qword [rbp + 0x1c0]
jmp 0x140061588
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xffffffff
jne 0x1400614ba
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1400d8108]
mov rcx, qword [rbp + 0x1c0]
call fcn.140043a22
mov eax, dword [rbp + 0x184]
or eax, 1
mov dword [rbp + 0x184], eax
mov rax, qword [rbp + 0x1c0]
jmp 0x140061588
lea rcx, [rbp + 0x48]
call fcn.140045999
nop
mov eax, dword [rbp + 0x24]
xor r8d, r8d
mov edx, eax
lea rcx, [rbp + 0x48]
call fcn.140042541
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1400427b7
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x84]
mov r8d, dword [rbp + 0x24]
mov rdx, rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0xa4], eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0xa4], 0
je 0x140061525
mov eax, dword [rbp + 0x24]
cmp dword [rbp + 0x84], eax
je 0x140061559
lea rdx, [0x1400d8108]
mov rcx, qword [rbp + 0x1c0]
call fcn.140043a22
mov eax, dword [rbp + 0x184]
or eax, 1
mov dword [rbp + 0x184], eax
lea rcx, [rbp + 0x48]
call fcn.140042afa
mov rax, qword [rbp + 0x1c0]
jmp 0x140061588
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x1c0]
call fcn.14004563d
mov eax, dword [rbp + 0x184]
or eax, 1
mov dword [rbp + 0x184], eax
lea rcx, [rbp + 0x48]
call fcn.140042afa
mov rax, qword [rbp + 0x1c0]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400d63a0]
call fcn.140045020
mov rax, rdi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.140043bb2
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x1400d40e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d4132
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d4132
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d4132
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d4132
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d4132
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d4134
xor al, al
add rsp, 0x28
ret

Function at 0x1400da428
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400da224