joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e980
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402338a8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x68], rbx
je 0x14005eb06
cmp byte [rcx + 0x71], bl
je 0x14005eb06
or edx, 0xffffffff
call fcn.14005d880
cmp eax, 0xffffffff
jne 0x14005e9e1
xor al, al
jmp 0x14005eb0b
mov qword [rbp + 0x2f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x27], 8
xor eax, eax
mov qword [rbp + 0x17], rax
mov byte [rbp + 0x1f], bl
lea esi, [rax + 1]
mov r10, qword [rdi + 0x68]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
mov r9, qword [rbp + 0x27]
add r9, rcx
lea r8, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae r8, qword [rbp + 0x17]
mov rax, qword [r10]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
lea rdx, [rdi + 0x74]
mov rcx, r10
mov rax, qword [rax + 0x40]
call qword [case.0x140055453.0]
mov ecx, eax
test eax, eax
je 0x14005ea52
sub ecx, esi
je 0x14005ea55
cmp ecx, 2
jne 0x14005eac1
jmp 0x14005eabe
mov byte [rdi + 0x71], bl
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rax, qword [rbp + 0x17]
mov r14, qword [rbp + 0xf]
sub r14, rax
je 0x14005ea95
lfence
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
mov r9, qword [rdi + 0x80]
mov r8, r14
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x14005eabb
cmp byte [rdi + 0x71], bl
je 0x14005eab8
test r14, r14
jne 0x14005e9fd
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp + 0x17]
call fcn.14003a950
jmp 0x14005e9fd
mov bl, sil
mov sil, bl
mov bl, sil
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14005eb02
inc rdx
mov r11, qword [rbp + 0x17]
mov rax, r11
cmp rdx, 0x1000
jb 0x14005eafa
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eafa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.14015449c
mov al, bl
jmp 0x14005eb0b
mov eax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140154030
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14005f80c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
xor edx, edx
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [rdi + rdx + 0x10]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, 8
jb 0x14005f82e
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14005f885
cmp qword [rcx + rdx*8], rdi
jne 0x14005f87a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14005f87e
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005f892
cmp qword [rcx + rdx*8], rdi
jne 0x14005f892
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x48]
dec qword [r8 + 0x10]
call fcn.14005ed1c
mov rcx, qword [rdi + 0x48]
mov edx, 0x30
call fcn.14015449c
lea rcx, [rdi + 0x30]
call fcn.14005ed1c
mov rcx, qword [rdi + 0x30]
mov edx, 0x30
call fcn.14015449c
mov edx, 0x58
mov rcx, rdi
call fcn.14015449c
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140064d98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1402338a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov rsi, rdx
mov r10, rcx
mov qword [rsp + 0x20], rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [r8 + rdx]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x140064dd6
mov r9, qword [r10 + 0x30]
and r9, rcx
add r9, r9
mov rax, qword [r10 + 0x18]
lea r11, [r10 + 8]
mov rdi, qword [r11]
cmp rdi, qword [rax + r9*8]
je 0x140064e52
mov rdi, qword [rax + r9*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r9*8]
je 0x140064e52
mov rcx, qword [r8]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x140064e33
cmp rdi, qword [rax + r9*8]
jne 0x140064e21
jmp 0x140064e52
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, r11
call fcn.140067c8c
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140064ee5
mov rax, qword [rbx]
cmp rdi, rax
je 0x140064e87
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r10 + 0x18]
mov rax, qword [rcx + r9*8]
cmp rax, qword [r11]
jne 0x140064ea3
mov qword [rcx + r9*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r9*8 + 8], rbx
jmp 0x140064ed2
cmp rax, rdi
jne 0x140064eae
mov qword [rcx + r9*8], rbx
jmp 0x140064ed2
mov rax, qword [rcx + r9*8 + 8]
mov rdx, qword [rax]
mov qword [rcx + r9*8 + 8], rdx
cmp rdx, rbx
je 0x140064ed2
mov r8, qword [r10 + 0x18]
mov rax, qword [r8 + r9*8 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r9*8 + 8], rdx
mov rcx, r10
call fcn.1400679cc
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154030
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140068cc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r10, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [r8 + rdx + 0x10]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, 8
jb 0x140068cd8
mov rdx, qword [r10 + 0x30]
mov r9, qword [r10 + 0x18]
and rdx, rcx
add rdx, rdx
cmp qword [r9 + rdx*8 + 8], r8
jne 0x140068d35
cmp qword [r9 + rdx*8], r8
jne 0x140068d2a
mov rax, qword [r10 + 8]
mov qword [r9 + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140068d42
mov rax, qword [r8 + 8]
mov qword [r9 + rdx*8 + 8], rax
jmp 0x140068d42
cmp qword [r9 + rdx*8], r8
jne 0x140068d42
mov rcx, qword [r8]
mov qword [r9 + rdx*8], rcx
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.140067c8c
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140071ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402338a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov r14, rdx
mov r10, rcx
mov qword [rsp + 0x20], rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [r8 + rdx]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x140071be0
mov r9, qword [r10 + 0x30]
and r9, rcx
add r9, r9
mov rax, qword [r10 + 0x18]
mov rdi, qword [r10 + 8]
cmp rdi, qword [rax + r9*8]
je 0x140071ca2
mov rdi, qword [rax + r9*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r9*8]
je 0x140071ca2
mov rcx, qword [r8]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x140071c3e
cmp rdi, qword [rax + r9*8]
jne 0x140071c2c
jmp 0x140071ca2
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
lea rcx, [rbx + 0x48]
call fcn.14005ed1c
mov edx, 0x30
mov rcx, qword [rbx + 0x48]
call fcn.14015449c
lea rcx, [rbx + 0x30]
call fcn.14005ed1c
mov edx, 0x30
mov rcx, qword [rbx + 0x30]
call fcn.14015449c
mov edx, 0x58
mov rcx, rbx
call fcn.14015449c
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140071d37
mov rax, qword [rbx]
cmp rdi, rax
je 0x140071cd7
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r10 + 0x18]
mov rax, qword [rcx + r9*8]
cmp rax, qword [r10 + 8]
jne 0x140071cf4
mov qword [rcx + r9*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r9*8 + 8], rbx
jmp 0x140071d23
cmp rax, rdi
jne 0x140071cff
mov qword [rcx + r9*8], rbx
jmp 0x140071d23
mov rax, qword [rcx + r9*8 + 8]
mov rdx, qword [rax]
mov qword [rcx + r9*8 + 8], rdx
cmp rdx, rbx
je 0x140071d23
mov r8, qword [r10 + 0x18]
mov rax, qword [r8 + r9*8 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r9*8 + 8], rdx
mov rcx, r10
call fcn.140072f38
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154030
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009c398
Capabilities:
Start service
Stop service

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
mov sil, cl
mov ebx, 0x10
mov r8d, ebx
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14009c49d
mov r8d, ebx
lea rdx, str.wdnisdrv
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x38]
test rax, rax
je 0x14009c4af
xor r8d, r8d
mov rcx, rax
test sil, sil
je 0x14009c442
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14009c435
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14009c435
mov edx, 1
jmp 0x14009c437
xor dl, dl
mov rcx, qword [rsp + 0x38]
test dl, dl
jne 0x14009c48b
jmp 0x14009c456
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14009c479
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r8, str.amcore_smartscreen_srcclient_network_filter_srcdriver_connection.cpp
mov edx, 0x20
call fcn.14004eb18
int3
lea r8, str.amcore_smartscreen_srcclient_network_filter_srcdriver_connection.cpp
mov edx, 0x1c
call fcn.14004eb18
nop
lea r8, str.amcore_smartscreen_srcclient_network_filter_srcdriver_connection.cpp
mov edx, 0x15
call fcn.14004eb18
nop
lea r8, str.amcore_smartscreen_srcclient_network_filter_srcdriver_connection.cpp
mov edx, 0x18
call fcn.14004eb18
int3
Function at 0x1400a3d70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x1400a3de4
call fcn.1400a40e4
mov ebx, eax
mov rcx, qword [0x14022f048]
lea rax, [0x14022f048]
cmp rcx, rax
je 0x1400a3de0
test byte [rcx + 0x1c], 1
je 0x1400a3de0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401cc5d8]
mov edx, 0x29
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.1400a1c04
mov eax, ebx
jmp 0x1400a3e06
cmp r9d, ebx
ja 0x1400a3dfa
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x1400a3e01
mov eax, 0x8000ffff
jmp 0x1400a3e06
test ebx, ebx
je 0x1400a3e01
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a3ff8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400a4061
call fcn.1400a40e4
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x1400a405d
mov rcx, qword [0x14022f048]
lea rax, [0x14022f048]
cmp rcx, rax
je 0x1400a405d
test byte [rcx + 0x1c], 1
je 0x1400a405d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401cc5d8]
mov edx, 0x2e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1400a1c04
mov eax, ebx
jmp 0x1400a4065
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a564c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, qword [r9]
mov rdi, r9
mov eax, r15d
mov r12, r8
mov dword [rsp + 0x78], eax
mov rbp, rdx
cmp rax, r15
je 0x1400a5684
mov ebx, 0x80070057
jmp 0x1400a57c1
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9, r12
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x1400a570c
test r14, r14
je 0x1400a56d4
mov eax, dword [rsp + 0x78]
cmp rax, qword [rdi]
jbe 0x1400a56d4
mov qword [rdi], rax
mov ebx, 0x800700ea
jmp 0x1400a57c1
mov eax, dword [rsp + 0x78]
mov qword [rdi], rax
lfence
mov r8d, dword [r12]
mov r9, rdi
mov rdx, r15
mov qword [rsp + 0x20], r14
mov rcx, rbp
call fcn.1400a5578
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ebx, 0x80070002
cmp esi, ebx
jne 0x1400a575a
mov rcx, qword [0x14022f048]
lea rax, [0x14022f048]
cmp rcx, rax
je 0x1400a57c1
test byte [rcx + 0x1c], 4
je 0x1400a57c1
lfence
mov rcx, qword [0x14022f048]
lea r8, [0x1401cc628]
mov edx, 0x15
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.1400151c4
jmp 0x1400a57c1
mov ebx, 0x800700ea
cmp esi, ebx
je 0x1400a57a6
mov rcx, qword [0x14022f048]
lea rax, [0x14022f048]
cmp rcx, rax
je 0x1400a57a2
test byte [rcx + 0x1c], 1
je 0x1400a57a2
lfence
mov rcx, qword [0x14022f048]
lea r8, [0x1401cc628]
mov edx, 0x16
mov dword [rsp + 0x20], esi
mov r9, rbp
mov rcx, qword [rcx + 0x10]
call fcn.1400a1c04
mov ebx, esi
jmp 0x1400a57b9
mov eax, dword [rsp + 0x78]
cmp qword [rdi], rax
jb 0x1400a57b6
mov ebx, 0x8000ffff
jmp 0x1400a57c1
mov qword [rdi], rax
test ebx, ebx
jns 0x1400a56db
lfence
mov eax, ebx
jmp 0x1400a56f5
Function at 0x1400a5f18
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402338a8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x28], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x20], 0x650076
mov dword [rbp - 0x1c], 0x730072
mov dword [rbp - 0x18], 0x6f0069
mov dword [rbp - 0x14], 0x2e006e
mov dword [rbp - 0x10], 0x6c0064
mov dword [rbp - 0xc], 0x6c
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.1400a3b34
test eax, eax
js 0x1400a6087
mov byte [rbp - 0x40], dil
xor r9d, r9d
lea r8, str.GetFileVersionInfoSizeExW
lea rdx, [rbp - 0x20]
lea rcx, [0x14022f028]
call fcn.1400a3c2c
mov r9b, 1
lea rdx, [rbp - 0x20]
test eax, eax
jns 0x1400a6002
lea rax, [0x1400a5db0]
mov qword [0x14022f028], rax
lea r8, [0x1401cc6c8]
lea rcx, [0x14022f020]
call fcn.1400a3c2c
test eax, eax
js 0x1400a6092
mov r9b, 1
lea r8, [0x1401cc6e0]
lea rdx, [rbp - 0x20]
lea rcx, [0x14022f040]
call fcn.1400a3c2c
test eax, eax
js 0x1400a607c
jmp 0x1400a601d
lea r8, str.GetFileVersionInfoExW
lea rcx, [0x14022f038]
call fcn.1400a3c2c
test eax, eax
js 0x1400a609d
mov r9b, 1
lea r8, [0x1401cc730]
lea rdx, [rbp - 0x20]
lea rcx, [0x14022f030]
call fcn.1400a3c2c
test eax, eax
js 0x1400a6071
mov rcx, qword [rbx]
mov rax, qword [rbp - 0x38]
mov qword [rbx], rax
test rcx, rcx
je 0x1400a6051
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140154030
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lfence
mov ecx, eax
call fcn.1400a31c4
int3
lfence
mov ecx, eax
call fcn.1400a31c4
nop
lfence
mov ecx, eax
call fcn.1400a31c4
nop
lfence
mov ecx, eax
call fcn.1400a31c4
int3
lfence
mov ecx, eax
call fcn.1400a31c4
int3
Function at 0x1400a8c40
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
movsxd rsi, edx
mov rdi, rcx
mov eax, esi
mov r11d, r8d
cdq
mov ebx, r8d
and edx, 0xf
movabs rbp, 0x87c37b91114253d5
add eax, edx
movabs r14, 0x4cf5ad432745937f
sar eax, 4
xor edx, edx
movsxd r10, eax
mov r8, r10
test eax, eax
jle 0x1400a8cde
mov rax, qword [rcx]
lea rcx, [rcx + 0x10]
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor rax, r11
rol rax, 0x1b
add rax, rbx
lea r11, [rax*4 + 0x52dce729]
add r11, rax
mov rax, qword [rcx - 8]
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor rax, rbx
rol rax, 0x1f
add rax, 0xb41def1
add rax, r11
lea rbx, [rax + rax*4]
sub r8, 1
jne 0x1400a8c8c
shl r10d, 4
mov ecx, esi
movsxd r8, r10d
and ecx, 0xf
add r8, rdi
cmp ecx, 8
ja 0x1400a8d3c
je 0x1400a8dbf
sub ecx, 1
je 0x1400a8e10
sub ecx, 1
je 0x1400a8e04
sub ecx, 1
je 0x1400a8df8
sub ecx, 1
je 0x1400a8dec
sub ecx, 1
je 0x1400a8de0
sub ecx, 1
je 0x1400a8dd4
cmp ecx, 1
je 0x1400a8dc8
jmp 0x1400a8e26
sub ecx, 9
je 0x1400a8da8
sub ecx, 1
je 0x1400a8d9c
sub ecx, 1
je 0x1400a8d90
sub ecx, 1
je 0x1400a8d84
sub ecx, 1
je 0x1400a8d78
sub ecx, 1
je 0x1400a8d6c
cmp ecx, 1
jne 0x1400a8e26
movzx edx, byte [r8 + 0xe]
shl rdx, 0x30
movzx eax, byte [r8 + 0xd]
shl rax, 0x28
xor rdx, rax
movzx eax, byte [r8 + 0xc]
shl rax, 0x20
xor rdx, rax
movzx eax, byte [r8 + 0xb]
shl rax, 0x18
xor rdx, rax
movzx eax, byte [r8 + 0xa]
shl rax, 0x10
xor rdx, rax
movzx eax, byte [r8 + 9]
shl rax, 8
xor rdx, rax
movzx eax, byte [r8 + 8]
xor rax, rdx
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor rbx, rax
movzx edx, byte [r8 + 7]
shl rdx, 0x38
movzx eax, byte [r8 + 6]
shl rax, 0x30
xor rdx, rax
movzx eax, byte [r8 + 5]
shl rax, 0x28
xor rdx, rax
movzx eax, byte [r8 + 4]
shl rax, 0x20
xor rdx, rax
movzx eax, byte [r8 + 3]
shl rax, 0x18
xor rdx, rax
movzx eax, byte [r8 + 2]
shl rax, 0x10
xor rdx, rax
movzx eax, byte [r8 + 1]
shl rax, 8
xor rdx, rax
movzx eax, byte [r8]
xor rax, rdx
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor r11, rax
mov rbp, qword [rsp + 0x18]
xor rbx, rsi
mov rdi, qword [rsp + 0x28]
mov rcx, rsi
mov rsi, qword [rsp + 0x20]
xor rcx, r11
add rcx, rbx
movabs r10, 0xff51afd7ed558ccd
mov rax, rcx
movabs r8, 0xc4ceb9fe1a85ec53
shr rax, 0x21
xor rax, rcx
imul rax, r10
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
lea rax, [rbx + rcx]
mov rbx, qword [rsp + 0x10]
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
imul rcx, r10
imul rdx, r8
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r8
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
mov rax, rdx
shr rax, 0x21
xor rax, rdx
add rax, rcx
mov qword [r9], rax
add rax, rcx
mov qword [r9 + 8], rax
pop r14
ret
Function at 0x1400b8b74
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov r11, rcx
mov rbx, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400b8ba1
mov r9, qword [rdx]
lea r10, [rbx + rbx]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1400b8bd4
movzx eax, byte [rcx + r9]
movabs rdi, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdi
cmp rcx, r10
jb 0x1400b8bb6
mov rbp, qword [r11 + 0x30]
mov r14, qword [r11 + 0x18]
and rbp, r8
mov r10, qword [r11 + 8]
add rbp, rbp
mov rax, qword [r14 + rbp*8]
cmp qword [r14 + rbp*8], r10
jne 0x1400b8bf5
mov rcx, r10
jmp 0x1400b8bfd
mov rcx, qword [r14 + rbp*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b8ca5
cmp qword [rdx + 0x18], 8
lea r8, [rax + 0x10]
mov rcx, rdx
jb 0x1400b8c17
mov rcx, qword [rdx]
mov rsi, qword [r8 + 0x18]
mov r9, qword [r8 + 0x10]
cmp rsi, 8
jb 0x1400b8c28
mov r8, qword [r8]
cmp r9, rbx
jne 0x1400b8c50
test r9, r9
je 0x1400b8c4a
sub r8, rcx
movzx r11d, word [rcx + r8]
cmp r11w, word [rcx]
jne 0x1400b8c55
add rcx, 2
sub r9, 1
jne 0x1400b8c35
xor ecx, ecx
test ecx, ecx
je 0x1400b8c5e
mov rax, qword [rax]
jmp 0x1400b8bea
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400b8c4c
lea rcx, [rax + 0x10]
cmp rsi, 8
jb 0x1400b8c6b
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400b8c75
mov rdx, qword [rdx]
test rbx, rbx
je 0x1400b8c92
sub rdx, rcx
movzx r8d, word [rcx + rdx]
cmp r8w, word [rcx]
jne 0x1400b8c9c
add rcx, 2
sub rbx, 1
jne 0x1400b8c7d
xor ecx, ecx
test ecx, ecx
cmovne rax, r10
jmp 0x1400b8ca8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400b8c94
mov rax, r10
cmp rax, r10
je 0x1400b8ccc
mov rbx, qword [rsp + 0x30]
add rax, 0x30
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.14003b5ac
int3
Function at 0x1400bd748
Capabilities:
Get system information on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1402338a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, r9
mov r15d, r8d
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x38], rdx
mov rax, qword gs:[0x58]
mov ecx, 8
mov rax, qword [rax]
mov edx, dword [rcx + rax]
cmp dword [0x1402cc6b8], edx
jg 0x1400bd875
mov rax, qword [0x1402cc6c0]
mov r8d, dword [rax]
xor edx, edx
mov rax, rbp
div r8
mov r14, rdx
mov rsi, rbp
sub rsi, rdx
mov rcx, qword [r13 + 0x38]
sub rcx, rsi
xor edx, edx
mov rax, rbp
div r8
mov rdi, qword [rsp + 0xe0]
add rdi, rdx
cmp rcx, rdi
cmovb rdi, rcx
mov rcx, qword [r13 + 0x30]
test rcx, rcx
je 0x1400bd822
mov r8, rsi
shr r8, 0x20
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400bd852
lea rdx, [r14 + rax]
sub rdi, rbp
lea rcx, [rdi + rsi]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
jmp 0x1400bd830
and qword [rbx], 0
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140154030
add rsp, 0x80
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, [0x1401cd1a8]
lea rcx, [rsp + 0x40]
call fcn.14003a784
lea rdx, [0x14022b0c8]
lea rcx, [rsp + 0x40]
call fcn.1401556e8
nop
lea rcx, [0x1402cc6b8]
call fcn.140154680
cmp dword [0x1402cc6b8], 0xffffffff
jne 0x1400bd7a3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x68]
mov dword [0x1402ccc00], eax
lea rax, [0x1402ccc00]
mov qword [0x1402cc6c0], rax
lea rcx, [0x1402cc6b8]
call fcn.140154620
jmp 0x1400bd7a3