joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016670
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011640
movzx eax, al
test eax, eax
jne 0x140016690
mov ecx, 7
call fcn.140011532
nop
mov byte [rsp + 0x20], 0
call fcn.14001156e
mov byte [rsp + 0x21], al
cmp dword [0x140023b78], 1
jne 0x1400166b4
mov ecx, 7
call fcn.140011532
nop
jmp 0x14001670c
cmp dword [0x140023b78], 0
jne 0x140016707
mov dword [0x140023b78], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.1400112f8
test eax, eax
je 0x1400166e8
mov eax, 0xff
jmp 0x140016811
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.14001155a
mov dword [0x140023b78], 2
jmp 0x14001670c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001151e
call fcn.140011488
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140016769
mov rcx, qword [rsp + 0x30]
call fcn.140011258
movzx eax, al
test eax, eax
je 0x140016769
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002a020]
nop
call fcn.1400114c9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001679d
mov rcx, qword [rsp + 0x38]
call fcn.140011258
movzx eax, al
test eax, eax
je 0x14001679d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400115e6
nop
call fcn.1400168c0
mov dword [rsp + 0x28], eax
call fcn.140011460
movzx eax, al
test eax, eax
jne 0x1400167bc
mov ecx, dword [rsp + 0x28]
call fcn.14001107d
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400167cb
call fcn.1400115f5
nop
xor edx, edx
mov cl, 1
call fcn.140011230
mov eax, dword [rsp + 0x28]
jmp 0x140016811
add rsp, 0x68
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400cc200]
mov dword [rax], 1
mov rax, qword [0x1400cc210]
mov dword [rax], 1
mov rax, qword [0x1400cc220]
mov dword [rax], 1
mov rax, qword [0x1400cc1f0]
mov dword [rax], 1
mov rax, qword [0x1400cc040]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400043e0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x140004410
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400043a5
mov rdx, rax
jmp 0x140004415
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000b176
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14000f032
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 1], 0
cmp qword [rbp + 0x18], 0
je 0x14000f056
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
jmp 0x14000f05b
mov eax, 0
mov qword [rbp - 0x20], rax
cmp qword [rbp + 0x10], 0
je 0x14000f06f
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
jmp 0x14000f074
mov eax, 0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x20]
cmp rax, qword [rbp - 0x10]
jg 0x14000f093
mov byte [rbp - 1], 1
jmp 0x14000f1bd
nop
mov byte [rbp - 0x11], 0
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x10]
setle al
mov byte [rbp - 0x11], al
cmp byte [rbp - 0x11], 0
jne 0x14000f170
cmp qword [rbp - 0x10], 0
js 0x14000f0d2
cmp qword [rbp + 0x10], 0
je 0x14000f0c7
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
jmp 0x14000f0cc
mov eax, 0
cmp rax, qword [rbp - 0x10]
jg 0x14000f0f9
cmp qword [rbp + 0x10], 0
je 0x14000f0e6
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rdx, [rax - 1]
jmp 0x14000f0ed
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000aa55
cmp qword [rbp - 0x10], 0
js 0x14000f11b
cmp qword [rbp + 0x18], 0
je 0x14000f110
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
jmp 0x14000f115
mov eax, 0
cmp rax, qword [rbp - 0x10]
jg 0x14000f142
cmp qword [rbp + 0x18], 0
je 0x14000f12f
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
lea rdx, [rax - 1]
jmp 0x14000f136
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14000aa55
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x10]
add rax, rdx
add rax, 0x10
movzx edx, byte [rax]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x10]
add rax, rcx
add rax, 0x10
movzx eax, byte [rax]
cmp dl, al
setne al
mov byte [rbp - 0x11], al
jmp 0x14000f171
nop
movzx eax, byte [rbp - 0x11]
xor eax, 1
test al, al
jne 0x14000f182
mov byte [rbp - 1], 0
jmp 0x14000f1bd
nop
mov edx, 0
mov rax, qword [rbp - 0x10]
add rax, 1
jno 0x14000f197
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x30]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x14000f1b0
call fcn.14000b94a
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
jmp 0x14000f080
movzx eax, byte [rbp - 1]
add rsp, 0x50
pop rbp
ret

Function at 0x1400184a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1400204e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140027bb0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140027bb0
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140021112
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400e5288]
test eax, eax
je 0x1400211aa
lea rax, [0x1400e5260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400e5290]
mov qword [rbp - 8], rax
jmp 0x14002118e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140021182
cmp qword [rbp - 0x10], 0
je 0x140021182
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140021148
lea rax, [0x1400e5260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400211ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400212b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400212d8
mov eax, 0
jmp 0x140021326
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140021301
mov eax, 0
jmp 0x140021326
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140021321
mov eax, 0
jmp 0x140021326
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14002132c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400213aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400213a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400213a1
mov rax, qword [rbp - 8]
jmp 0x1400213bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140021374
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140806058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408061df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140806089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14080606f
add dl, dl
jne 0x140806096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408060f6
xor eax, eax
add dl, dl
jne 0x1408060a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408061ad
add dl, dl
jne 0x1408060b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408060c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408060d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408060dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408060ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14080607e
mov eax, 1
add dl, dl
jne 0x140806106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140806113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408060fb
sub eax, ebx
mov ebx, 1
jne 0x14080614c
mov ecx, 1
add dl, dl
jne 0x14080612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14080613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140806123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14080607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140806168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140806175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14080615d
cmp eax, 0x7d00
jae 0x14080619b
cmp eax, 0x500
jb 0x140806196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14080607e
cmp eax, 0x7f
ja 0x14080619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14080607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408061d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14080607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14006bf59
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0xa08b9369
pushf
not eax
add eax, 0x1479c872
xor eax, 0x62136bd8
rol eax, 0x82
popf
pushf
not eax
add eax, 0x2f15517e
xor eax, 0x3de3f610
rol eax, 0x70
popf
pushf
not eax
add eax, 0x6ec279a8
xor eax, 0x267c8171
rol eax, 0xf
popf
pushf
not eax
add eax, 0x6f645b3e
xor eax, 0x5f7726c9
rol eax, 0
popf

Function at 0x140071ce4
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x5f8900d5
pushf
not eax
add eax, 0x4b4cdae5
xor eax, 0x331dd10c
rol eax, 0xc
popf
pushf
not eax
add eax, 0x234ffea5
xor eax, 0x429fc117
rol eax, 0x81
popf
Function at 0x140098b16
Capabilities:
Enumerate process modules

Disassembly:
invalid
push rax
pushf
mov eax, 0xba2898f8
pushf
not eax
add eax, 0x1ab832df
xor eax, 0x6db2637d
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x1a717525
xor eax, 0x6a985546
rol eax, 3
popf
pushf
not eax
add eax, 0x10b76530
xor eax, 0x424a4cf
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x30f7c2e3
xor eax, 0x1d6644da
rol eax, 0x37
popf
cmp eax, 0
jne switch.0x140098b7a
popf
pop rax
jmp switch.0x140098b7a
jmp qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
Function at 0x14009a5e6
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0x8419afe2
pushf
not eax
add eax, 0x283e5f0d
xor eax, 0x5f3fcedd
rol eax, 0xab
popf
pushf
not eax
add eax, 0x12c6d87f
xor eax, 0x37b718a6
rol eax, 0x7d
popf

Function at 0x1400a4511
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xb889085d
pushf
not eax
add eax, 0x174a28d7
xor eax, 0x61b1a327
rol eax, 8
popf
pushf
not eax
add eax, 0x9143f0a
xor eax, 0x6bb9143
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x7c1523e5
xor eax, 0xfadc1af
rol eax, 0x41
popf
pushf
not eax
add eax, 0x5bc0198d
xor eax, 0x2e67cd49
rol eax, 0x29
popf
cmp eax, 0
jne 0x1400a4574
popf
pop rax
jmp 0x1400a4592
cmp eax, 1
jne 0x1400a4583
popf
pop rax
jmp 0x1400a4669
cmp eax, 2
jne 0x1400a4592
popf
pop rax
jmp 0x1400a46ab
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1b3cefa1a]
pushf
sub r9, 0x73cbda4a
popf
xor ecx, ecx
lea r8, [0x18c6bedeb]
pushf
sub r8, 0x4c68ce23
popf
lea rdx, [0x1b4b9054e]
pushf
sub rdx, 0x74b5e57e
popf
call fcn.14000dd38
test rax, rax
je 0x1400a4636
push rax
pushf
mov eax, 0x33f7e7c8
pushf
not eax
add eax, 0x6868321c
xor eax, 0x276b83d7
rol eax, 0x32
popf
pushf
not eax
add eax, 0x4bd535a3
xor eax, 0x52f03978
rol eax, 0x74
popf
pushf
not eax
add eax, 0x2da5e41c
xor eax, 0x33598509
rol eax, 0x38
popf
pushf
not eax
add eax, 0x149b9729
xor eax, 0x4d3fdf33
rol eax, 0xaa
popf
jmp 0x1400a4565
push rax
pushf
mov eax, 0x30a89b65
pushf
not eax
add eax, 0x7f4a2e51
xor eax, 0x47310f3c
rol eax, 0x33
popf
pushf
not eax
add eax, 0x3e915eb
xor eax, 0x1130c966
rol eax, 7
popf
jmp 0x1400a4565
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1400a4888
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xf86ea8af
pushf
not eax
add eax, 0x332f3970
xor eax, 0x6acf8434
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x4da5df13
xor eax, 0x6505c0e9
rol eax, 0x24
popf
cmp eax, 0
jne 0x1400a48c5
popf
pop rax
jmp 0x1400a48e3
cmp eax, 1
jne 0x1400a48d4
popf
pop rax
jmp 0x1400a49d7
cmp eax, 2
jne 0x1400a48e3
popf
pop rax
jmp 0x1400a4a29
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18849c12d]
pushf
sub r9, 0x4846a135
popf
mov ecx, 0xa24d4c
pushf
not ecx
add ecx, 0x8ac15af
xor ecx, 0x8f45edf
rol ecx, 0xf8
popf
pushf
not ecx
add ecx, 0x3d54320d
xor ecx, 0x32cf450
rol ecx, 0x2e
popf
pushf
not ecx
add ecx, 0x127c5037
xor ecx, 0x2272af17
rol ecx, 0xbb
popf
lea r8, [0x1801808c1]
pushf
sub r8, 0x4014e8d1
popf
lea rdx, [0x1a0d6dcb2]
pushf
sub rdx, 0x60d3bcba
popf
call fcn.14000dd38
mov ecx, ebx
test rax, rax
je 0x1400a49a4
push rax
pushf
mov eax, 0xf9e75765
pushf
not eax
add eax, 0x1a46b506
xor eax, 0x8e2d287
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x1fc70c7e
xor eax, 0xa152798
rol eax, 0xc7
popf
jmp 0x1400a48b6
push rax
pushf
mov eax, 0x9956a031
pushf
not eax
add eax, 0x51c2888f
xor eax, 0x3e345783
rol eax, 0x73
popf
pushf
not eax
add eax, 0x21a2fece
xor eax, 0x2aaecbd0
rol eax, 0xc6
popf
jmp 0x1400a48b6
add rsp, 0x20
pop rbx
jmp qword [0x14002b4b0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400a4a35
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x4a358d7d
pushf
not eax
add eax, 0x188ed548
xor eax, 0x1b4edeed
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x5d8839d3
xor eax, 0xdde0aa0
rol eax, 0xff
popf
cmp eax, 3
jne 0x1400a4a72
popf
pop rax
jmp 0x1400a4c75
cmp eax, 0
jne 0x1400a4a81
popf
pop rax
jmp 0x1400a4a9f
cmp eax, 2
jne 0x1400a4a90
popf
pop rax
jmp 0x1400a4c29
cmp eax, 1
jne 0x1400a4a9f
popf
pop rax
jmp 0x1400a4bc4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1ad0f0b88]
pushf
sub r9, 0x6d0beb78
popf
mov edi, ecx
lea rdx, [0x1997e5403]
pushf
sub rdx, 0x597b33f3
popf
mov ecx, 0xacc1e58
pushf
not ecx
add ecx, 0x772f1167
xor ecx, 0x79de4ea6
rol ecx, 0xf7
popf
pushf
not ecx
add ecx, 0x2daddeab
xor ecx, 0x39a8d70d
rol ecx, 0xfa
popf
pushf
not ecx
add ecx, 0x91048dd
xor ecx, 0x39c197f
rol ecx, 0xae
popf
lea r8, [0x1a8ec97e0]
pushf
sub r8, 0x68e977d8
popf
call fcn.14000dd38
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400a4b7d
push rax
pushf
mov eax, 0x7d58c921
pushf
not eax
add eax, 0x706fa0e7
xor eax, 0x34452ceb
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x4226cb25
xor eax, 0x4b036b7b
rol eax, 6
popf
pushf
not eax
add eax, 0x7801c167
xor eax, 0x1c31b546
rol eax, 0xe3
popf
jmp 0x1400a4a63
push rax
pushf
mov eax, 0x76e209cf
pushf
not eax
add eax, 0x4e2c59b9
xor eax, 0x1fd81b50
rol eax, 0x35
popf
pushf
not eax
add eax, 0x46f5a12b
xor eax, 0x77de29e6
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xd048738
xor eax, 0x6342911f
rol eax, 0x53
popf
jmp 0x1400a4a63
call qword [0x14002b4b0]
jmp 0x1400a4c75
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x27919d7d
pushf
not eax
add eax, 0x7e502bee
xor eax, 0x3b4e25fb
rol eax, 0x67
popf
pushf
not eax
add eax, 0x4534e9a9
xor eax, 0x20f6ee93
rol eax, 0x70
popf
pushf
not eax
add eax, 0x682758c7
xor eax, 0x1ac5ec9c
rol eax, 0xa1
popf
jmp 0x1400a4a63
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a72ca
Capabilities:
Authenticate hmac
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x5b7eb72f
pushf
not eax
add eax, 0x74c5811b
xor eax, 0x5c81846d
rol eax, 0xea
popf
pushf
not eax
add eax, 0x352f0862
xor eax, 0x72ee375d
rol eax, 0x35
popf
pushf
not eax
add eax, 0x790a60f0
xor eax, 0x761dbe14
rol eax, 0x89
popf
cmp eax, 0
jne 0x1400a731a
popf
pop rax
jmp 0x1400a731a
mov r8, qword [rdx]
jmp fcn.1400a7322
Function at 0x140111770
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0xaadbb071
pushf
not eax
add eax, 0x7d74fbb4
xor eax, 0x65f69034
rol eax, 0xca
popf
pushf
not eax
add eax, 0x16688e1b
xor eax, 0x56fab33d
rol eax, 0xdc
popf
cmp eax, 0
jne 0x1401117ad
popf
pop rax
jmp 0x1401117ad
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400199d8
Function at 0x140146521
Capabilities:
Set environment variable

Disassembly:
push rax
pushf
mov eax, 0xd31e3413
pushf
not eax
add eax, 0x35e502c4
xor eax, 0x43b4b087
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x3bc5c025
xor eax, 0x1a5341ed
rol eax, 0x48
popf
cmp eax, 0
jne 0x14014655e
popf
pop rax
jmp 0x14014655e
jmp 0x140020c90
Function at 0x14014a4f7
Capabilities:
Enumerate files on windows

Disassembly:
push rax
pushf
mov eax, 0x5730a2c1
pushf
not eax
add eax, 0x396bd6e0
xor eax, 0x37cd5006
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x504e09bf
xor eax, 0x78bcd669
rol eax, 0x65
popf
pushf
not eax
add eax, 0x61cb7f21
xor eax, 0x593cfc3b
rol eax, 0x39
popf
pushf
not eax
add eax, 0x6046ea38
xor eax, 0x6059a1db
rol eax, 0x2a
popf
cmp eax, 0
jne 0x14014a55a
popf
pop rax
jmp 0x14014a55a
jmp 0x1400218e4
Function at 0x14017f4c6
Capabilities:
Clear file content

Disassembly:
push rax
pushf
mov eax, 0xbf26200f
pushf
not eax
add eax, 0x617f3e3a
xor eax, 0x398912
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x3143f0c3
xor eax, 0x7d9b2800
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x25b97438
xor eax, 0x4487a59c
rol eax, 0x82
popf

Function at 0x140180921
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse credit card information

Disassembly:
push rax
pushf
mov eax, 0x84ccb080
pushf
not eax
add eax, 0x498054d7
xor eax, 0x3b43de58
rol eax, 0x20
popf
pushf
not eax
add eax, 0x1824560b
xor eax, 0x5a958ced
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x771eb02e
xor eax, 0x69288041
rol eax, 7
popf
pushf
not eax
add eax, 0x70fb38db
xor eax, 0xf3f47d6
rol eax, 6
popf

Function at 0x14018396d
Capabilities:
Authenticate hmac
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xc2488d38
pushf
not eax
add eax, 0x5064f484
xor eax, 0x50317f92
rol eax, 0x76
popf
pushf
not eax
add eax, 0x45d5ca9f
xor eax, 0x6c9d0eb4
rol eax, 0x17
popf
pushf
not eax
add eax, 0x15528fa9
xor eax, 0x7f411bc1
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x7b5b2dfc
xor eax, 0x1af9782a
rol eax, 2
popf
Function at 0x140002f80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002fdd
lea rbx, [0x140061ad0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002fc4
cmp r10, 2
jb 0x140002fc4
cmp byte [r9], r8b
jne 0x140002fc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002fa0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000301f
lea rbx, [0x140061ad0]
cmp r8b, 0x23
jne 0x140003003
cmp byte [r9], r8b
jne 0x140003003
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002ff0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000317a
mov qword [r8], 0
lea rdx, [0x140061630]
call fcn.140003030
mov rbx, rax
test rax, rax
jne 0x14000319a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003273
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003273
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003273
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003273
cmp rdi, 0xffffffffffffffff
je 0x140003273
mov rax, qword [0x140078060]
test rax, rax
je 0x140003210
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003273
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140078060]
test rax, rax
je 0x140003255
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000327c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000326e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000327e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret