joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003a90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x10
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rsp], rax
mov rdi, qword [r8 + 0x18]
mov r10, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r9, r8
cmp rdi, 8
jb 0x140003aca
mov r9, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x140003b04
movabs rbx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
inc rcx
xor r8, rax
imul r8, rbx
cmp rcx, rdx
jb 0x140003af0
and r8, qword [0x14000c720]
mov rdx, qword [0x14000c708]
mov rcx, r8
mov rbx, qword [0x14000c6f8]
add rcx, rcx
lea rax, [r8 + r8]
mov rbp, qword [rdx + rax*8]
lea r14, [rdx + rax*8]
mov rcx, qword [rdx + rcx*8]
mov r8, rcx
mov rdx, rcx
cmp rbp, rbx
jne 0x140003b3f
mov rax, rbx
jmp 0x140003b49
mov rax, qword [r14 + 8]
mov rdx, r8
mov rax, qword [rax]
cmp rdx, rax
je 0x140003be9
mov rax, r10
cmp rdi, 8
jb 0x140003b5e
mov rax, qword [r10]
cmp qword [rcx + 0x28], 8
lea r9, [rcx + 0x10]
jb 0x140003b6d
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 0x20]
cmp r8, r11
jne 0x140003bd9
test r8, r8
je 0x140003b94
sub r9, rax
nop
movzx edx, word [rax]
cmp word [rax + r9], dx
jne 0x140003bd9
add rax, 2
sub r8, 1
jne 0x140003b80
cmp qword [rcx + 0x28], 8
lea rdx, [rcx + 0x10]
jb 0x140003ba3
mov rdx, qword [rcx + 0x10]
cmp rdi, 8
jb 0x140003bac
mov r10, qword [r10]
cmp r11, qword [rcx + 0x20]
jne 0x140003be1
test r11, r11
je 0x140003be4
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r10], ax
jne 0x140003be1
add rdx, 2
sub r11, 1
jne 0x140003bc0
mov qword [rsi], rcx
jmp 0x140003bec
mov rcx, qword [rcx]
jmp 0x140003b2f
mov rcx, rbx
mov qword [rsi], rcx
jmp 0x140003bec
mov qword [rsi], rbx
mov rax, rsi
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140005ef0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
Function at 0x140003c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x10
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rsp], rax
mov rdi, qword [r8 + 0x18]
mov r10, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r9, r8
cmp rdi, 8
jb 0x140003c6a
mov r9, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x140003ca4
movabs rbx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
inc rcx
xor r8, rax
imul r8, rbx
cmp rcx, rdx
jb 0x140003c90
and r8, qword [0x14000c760]
mov rdx, qword [0x14000c748]
mov rcx, r8
mov rbx, qword [0x14000c738]
add rcx, rcx
lea rax, [r8 + r8]
mov rbp, qword [rdx + rax*8]
lea r14, [rdx + rax*8]
mov rcx, qword [rdx + rcx*8]
mov r8, rcx
mov rdx, rcx
cmp rbp, rbx
jne 0x140003cdf
mov rax, rbx
jmp 0x140003ce9
mov rax, qword [r14 + 8]
mov rdx, r8
mov rax, qword [rax]
cmp rdx, rax
je 0x140003d89
mov rax, r10
cmp rdi, 8
jb 0x140003cfe
mov rax, qword [r10]
cmp qword [rcx + 0x28], 8
lea r9, [rcx + 0x10]
jb 0x140003d0d
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 0x20]
cmp r8, r11
jne 0x140003d79
test r8, r8
je 0x140003d34
sub r9, rax
nop
movzx edx, word [rax]
cmp word [rax + r9], dx
jne 0x140003d79
add rax, 2
sub r8, 1
jne 0x140003d20
cmp qword [rcx + 0x28], 8
lea rdx, [rcx + 0x10]
jb 0x140003d43
mov rdx, qword [rcx + 0x10]
cmp rdi, 8
jb 0x140003d4c
mov r10, qword [r10]
cmp r11, qword [rcx + 0x20]
jne 0x140003d81
test r11, r11
je 0x140003d84
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r10], ax
jne 0x140003d81
add rdx, 2
sub r11, 1
jne 0x140003d60
mov qword [rsi], rcx
jmp 0x140003d8c
mov rcx, qword [rcx]
jmp 0x140003ccf
mov rcx, rbx
mov qword [rsi], rcx
jmp 0x140003d8c
mov qword [rsi], rbx
mov rax, rsi
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140005ef0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x10
pop r14
pop rdi
pop rsi
ret
Function at 0x1400053e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x14000540b
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x140005444
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x140005430
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140005484
cmp rax, rdi
jne 0x14000547a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x14000548f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14000548f
cmp rax, rdi
jne 0x14000548f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.140003db0
mov rcx, rdi
call fcn.1400062dc
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002c78
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002c78
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140002c65
nop
cmp rbx, rcx
jae 0x140002c78
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140002c50
cmp rbx, rcx
jae 0x140002c78
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x140002c7a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006f80
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [0x14017ac3e], 0
jne 0x140006ff5
lea rcx, str.kernel32.dll
mov qword [rsp + 0x30], rdi
mov byte [0x14017ac3e], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140006fe7
lea rdx, str.GetProcessInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessInformation
mov rcx, rdi
mov qword [0x14017ae00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017adf8], rax
mov rdi, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400094b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x820
mov rsi, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x20]
call fcn.14012ce40
mov bpl, 1
mov rax, qword [r14]
cmp dword [rax - 0x10], 0
jne 0x140009655
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14000967c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x840], rax
xor r9d, r9d
lea r8, [rsp + 0x840]
lea rdx, str.LogFolder
mov rcx, qword [r14 + 8]
call fcn.140073b00
test al, al
je 0x1400095fd
mov rdi, 0xffffffffffffffff
mov r9, rdi
mov rbx, qword [rsp + 0x840]
mov r8, rbx
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.140115f0c
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009571
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp word [rsp + 0x20], 0
je 0x140009623
lea rax, [rsp + 0x20]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140009585
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], 0
jl 0x14000962e
lea rbx, str.logs
mov rdx, rbx
call fcn.140100b40
test rax, rax
je 0x14000962e
mov rcx, qword [rsi]
sub rax, rcx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000962e
movsxd rcx, dword [rcx - 0x10]
sub rcx, 4
cdqe
cmp rax, rcx
jae 0x14000962e
mov rcx, rsi
call fcn.140075a30
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400095e3
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140005c50
jmp 0x14000962e
mov rdx, qword [rsp + 0x840]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140009623
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, rsi
call fcn.140009690
xor bpl, bpl
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000964a
xor r8d, r8d
mov rdx, qword [rsi]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rdx, rsi
mov rcx, r14
call fcn.14003f3d0
mov rdx, r14
mov rcx, rsi
call fcn.14003f3d0
movzx eax, bpl
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140002b00
int3
Function at 0x140009690
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x820
mov rdi, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x800
call fcn.14012ce40
call fcn.140134523
mov ecx, 0x23
lea rdx, [rsp + 0x20]
test al, al
mov r8d, 0x1c
cmovne r8d, ecx
lea r9d, [rcx - 0x22]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1400097da
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400096f5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005a90
mov rdx, qword [rdi]
movsxd rax, dword [rdx - 0x10]
test eax, eax
je 0x140009733
lea ecx, [rax - 1]
test ecx, ecx
js 0x140009844
cmp ecx, eax
jg 0x140009844
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140009740
mov edx, 0x5c
mov rcx, rdi
call fcn.14003f280
lea rdx, [0x1401454c0]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140009750
mov rcx, rdi
call fcn.140005c50
mov r8, qword [rdi]
movsxd rax, dword [r8 - 0x10]
test eax, eax
je 0x14000978a
lea ecx, [rax - 1]
test ecx, ecx
js 0x140009844
cmp ecx, eax
jg 0x140009844
cmp word [r8 + rax*2 - 2], 0x5c
je 0x140009797
mov edx, 0x5c
mov rcx, rdi
call fcn.14003f280
lea rdx, str.logs
nop
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x1400097a0
mov r8d, ebx
mov rcx, rdi
call fcn.140005c50
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400097d1
mov rdx, qword [rdi]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, qword [rdi]
movsxd rax, dword [rax - 0x10]
jmp 0x14000982f
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
lea rdx, [rax - 0x18]
mov rsi, qword [rdx]
je 0x14000982d
cmp dword [rdx + 0x10], 0
jge 0x140009803
cmp dword [rax - 0xc], 0
jl 0x140009844
xor ecx, ecx
mov dword [rax - 0x10], ecx
mov rax, qword [rdi]
mov word [rax], cx
jmp 0x14000982d
mov rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000981d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
xor eax, eax
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80070057
call fcn.140002b00
int3
Function at 0x140009850
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400099e2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
lea rcx, [0x14017c550]
call fcn.1400094b0
call fcn.140002e00
test rax, rax
je 0x1400099ed
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea r9, str.processlasso.log
mov r8, qword [rsp + 0x60]
lea rdx, [0x140146d78]
lea rcx, [rsp + 0x58]
call fcn.140005d70
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400098f1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000990f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor esi, esi
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400099ed
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], esi
lea r9, str.processlasso.log
mov r8, qword [rsp + 0x60]
lea rdx, str._s_s._u
lea rcx, [rsp + 0x50]
call fcn.140005d70
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000999c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000999c
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000998b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc esi
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x1400099ed
jmp 0x140009922
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400099b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400099da
mov rcx, qword [rdx]
mov rax, qword [rcx]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
jmp qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3
Function at 0x140009a10
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
lea ecx, [rsi + 0x48]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov qword [rsp + 0x50], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
lea ecx, [rsi + 0x28]
call fcn.1400ff088
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
cmp byte [0x14017cd2c], sil
jne 0x140009b0c
mov byte [0x14017cd2c], 1
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.GetProcessDefaultCpuSets
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae08], rax
lea rdx, str.SetProcessDefaultCpuSets
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae18], rax
lea rdx, str.GetSystemCpuSetInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae10], rax
lea rdx, str.GetProcessDefaultCpuSetMasks
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae28], rax
lea rdx, str.SetProcessDefaultCpuSetMasks
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae20], rax
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000c7e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, r9
mov esi, r8d
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
call fcn.1400d8994
test eax, eax
jne 0x14000c95f
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14000c94f
movzx edx, dil
movabs r11, 0xcbf29ce484222325
xor rdx, r11
movabs r10, 0x100000001b3
imul rdx, r10
movzx eax, byte [rsp + 0x49]
xor rdx, rax
imul rdx, r10
movzx eax, byte [rsp + 0x4a]
xor rdx, rax
imul rdx, r10
movzx eax, byte [rsp + 0x4b]
xor rdx, rax
imul rdx, r10
and rdx, qword [rbx + 0x140]
shl rdx, 4
add rdx, qword [rbx + 0x128]
mov rcx, qword [rdx + 8]
mov rax, qword [rbx + 0x118]
xor r9d, r9d
cmp rcx, rax
je 0x14000c8a1
mov rdx, qword [rdx]
cmp edi, dword [rcx + 0x10]
je 0x14000c8a4
cmp rcx, rdx
je 0x14000c8a1
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x14000c891
jmp 0x14000c8a4
mov rcx, r9
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
je 0x14000c92f
movzx r8d, sil
xor r8, r11
imul r8, r10
movzx eax, byte [rsp + 0x51]
xor r8, rax
imul r8, r10
movzx eax, byte [rsp + 0x52]
xor r8, rax
imul r8, r10
movzx eax, byte [rsp + 0x53]
xor r8, rax
imul r8, r10
mov rdx, qword [rcx + 0x48]
and rdx, r8
shl rdx, 4
add rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 8]
mov rcx, qword [rcx + 0x20]
cmp rax, rcx
je 0x14000c917
mov rdx, qword [rdx]
cmp esi, dword [rax + 0x10]
je 0x14000c91a
cmp rax, rdx
je 0x14000c917
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x14000c907
jmp 0x14000c91a
mov rax, r9
test rax, rax
cmove rax, rcx
cmp rax, rcx
je 0x14000c92f
mov dil, 1
mov r9d, dword [rax + 0x14]
jmp 0x14000c932
xor dil, dil
mov dword [r14], r9d
mov rcx, rbx
call fcn.1400d899c
movzx eax, dil
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1400d7b54
int3
mov ecx, 5
call fcn.1400d7b54
int3
Function at 0x14000ca10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, r9
mov esi, r8d
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
call fcn.1400d8994
test eax, eax
jne 0x14000cb8f
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14000cb7f
movzx edx, dil
movabs r11, 0xcbf29ce484222325
xor rdx, r11
movabs r10, 0x100000001b3
imul rdx, r10
movzx eax, byte [rsp + 0x49]
xor rdx, rax
imul rdx, r10
movzx eax, byte [rsp + 0x4a]
xor rdx, rax
imul rdx, r10
movzx eax, byte [rsp + 0x4b]
xor rdx, rax
imul rdx, r10
and rdx, qword [rbx + 0x180]
shl rdx, 4
add rdx, qword [rbx + 0x168]
mov rcx, qword [rdx + 8]
mov rax, qword [rbx + 0x158]
xor r9d, r9d
cmp rcx, rax
je 0x14000cad1
mov rdx, qword [rdx]
cmp edi, dword [rcx + 0x10]
je 0x14000cad4
cmp rcx, rdx
je 0x14000cad1
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x14000cac1
jmp 0x14000cad4
mov rcx, r9
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
je 0x14000cb5f
movzx r8d, sil
xor r8, r11
imul r8, r10
movzx eax, byte [rsp + 0x51]
xor r8, rax
imul r8, r10
movzx eax, byte [rsp + 0x52]
xor r8, rax
imul r8, r10
movzx eax, byte [rsp + 0x53]
xor r8, rax
imul r8, r10
mov rdx, qword [rcx + 0x48]
and rdx, r8
shl rdx, 4
add rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 8]
mov rcx, qword [rcx + 0x20]
cmp rax, rcx
je 0x14000cb47
mov rdx, qword [rdx]
cmp esi, dword [rax + 0x10]
je 0x14000cb4a
cmp rax, rdx
je 0x14000cb47
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x14000cb37
jmp 0x14000cb4a
mov rax, r9
test rax, rax
cmove rax, rcx
cmp rax, rcx
je 0x14000cb5f
mov dil, 1
mov r9, qword [rax + 0x18]
jmp 0x14000cb62
xor dil, dil
mov qword [r14], r9
mov rcx, rbx
call fcn.1400d899c
movzx eax, dil
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1400d7b54
int3
mov ecx, 5
call fcn.1400d7b54
int3
Function at 0x14000cba0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
call fcn.1400d8994
test eax, eax
jne 0x14000cca2
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14000cc92
movzx ecx, dil
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [rsp + 0x39]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x3a]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x3b]
xor rcx, rax
imul rcx, rdx
mov rdx, qword [rbx + 0x80]
and rdx, rcx
add rdx, rdx
mov r8, qword [rbx + 0x68]
mov rax, qword [r8 + rdx*8 + 8]
mov rcx, qword [rbx + 0x58]
cmp rax, rcx
je 0x14000cc56
mov rdx, qword [r8 + rdx*8]
cmp edi, dword [rax + 0x10]
je 0x14000cc58
cmp rax, rdx
je 0x14000cc56
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x14000cc46
jmp 0x14000cc58
xor eax, eax
test rax, rax
cmove rax, rcx
cmp rax, rcx
jne 0x14000cc69
xorps xmm0, xmm0
jmp 0x14000cc6e
movsd xmm0, qword [rax + 0x18]
setne dil
movsd qword [rsi], xmm0
mov rcx, rbx
call fcn.1400d899c
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1400d7b54
int3
mov ecx, 5
call fcn.1400d7b54
int3
Function at 0x14000ecf0
Capabilities:
Set registry value

Disassembly:
movzx r8d, dl
lea rcx, [0x14017c4f0]
lea rdx, str.PauseListOnRightClick
jmp fcn.140073e30
Function at 0x140013fa0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x830
mov rsi, r8
mov edi, edx
mov rbp, qword [0x14017ae30]
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x14017d2a0], eax
jg 0x1400140b6
mov edx, edi
call fcn.140076530
test al, al
je 0x14001408a
xor ebx, ebx
mov word [rsp + 0x30], bx
mov r9d, 0x3ff
lea r8, [rsp + 0x30]
mov edx, 0x4c7
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140014060
cmp byte [0x1401776f0], bl
je 0x140014031
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], bl
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rsp + 0x30]
mov edx, 0x4c7
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140014060
mov word [rsp + 0x30], bx
lea rax, [0x140174690]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000040
lea r8, str.Process_Lasso
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400c17c0
mov al, 1
jmp 0x14001408c
xor al, al
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [0x14017d2a0]
call fcn.1400fec60
jmp 0x140013fe3
lea rcx, [0x14017d2a0]
call fcn.1400feccc
cmp dword [0x14017d2a0], 0xffffffff
jne 0x140013fe3
lea rcx, [0x14017d1a0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [0x14017ac3e], 0
jne 0x1400140a5
mov byte [0x14017ac3e], 1
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400140a5
lea rdx, str.GetProcessInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017ae00], rax
lea rdx, str.SetProcessInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017adf8], rax
jmp 0x1400140a5