joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f450
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0x2d587308
mov r12, rcx
mov rcx, qword [0x1400625d0]
call fcn.14000ae80
mov edx, 0x687f988
mov rcx, rax
call fcn.14000b5e0
mov rbx, qword [0x1400625e0]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
lea rsi, [rax + 0x20]
nop word [rax + rax]
movzx eax, word [r12]
mov rdx, r12
test ax, ax
je 0x14000f4d0
nop dword [rax]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000f550
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000f4b0
mov r8, qword [rdi + 0x50]
movzx eax, word [r8]
test ax, ax
je 0x14000f500
mov rdx, r8
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x14000f570
add eax, 0x20
add rdx, 2
mov word [rdx - 2], ax
movzx eax, word [rdx]
test ax, ax
jne 0x14000f4e0
mov rdx, r8
mov rcx, r12
call fcn.14000bbe0
mov edx, 0x529e1b08
mov rcx, rbx
mov rbp, rax
call fcn.14000ae80
mov edx, 0x6b27f188
mov rcx, rax
call fcn.14000b5e0
test rbp, rbp
je 0x14000f586
mov rdi, qword [rdi]
cmp rsi, rdi
jne 0x14000f4a0
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x14000f370
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000f4b0
jmp 0x14000f4d0
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000f4e0
jmp 0x14000f500
mov rax, qword [rdi + 0x20]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400119d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [fcn.14001b850]
mov rsi, qword [rcx]
mov ecx, 1
call r12
mov rdi, rax
test rsi, rsi
je 0x140011aa3
cmp qword [rsi], 0
lea r8, [rsi + 0x10]
mov rcx, rdi
lea rax, [0x140060240]
lea rbp, [0x140060241]
cmove r8, rax
mov rdx, rbp
call fcn.14000d960
mov ebx, eax
movsxd rax, ebx
cmp rax, qword [rsi]
jge 0x140011a47
cmp byte [rsi + rax + 0x10], 0
jne 0x140011a88
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x140011a47
add ebx, 1
movsxd rax, ebx
cmp rax, qword [rsi]
jl 0x140011a27
mov ecx, 1
call r12
mov r8d, 1
mov edx, 1
lea rcx, [0x140060292]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call r12
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fflush
lea r8, [rsi + rax + 0x10]
mov rdx, rbp
mov rcx, rdi
call fcn.14000d960
test eax, eax
jle 0x140011a47
add ebx, eax
jmp 0x140011a1f
lea rbp, [0x140060241]
lea r8, [0x140060240]
mov rcx, rax
mov rdx, rbp
call fcn.14000d960
mov ebx, eax
nop
test ebx, ebx
jns 0x140011a47
movsxd rax, ebx
cmp byte [rax + 0x10], 0
jne 0x140011af3
xor ecx, ecx
mov rdx, rdi
call sub.msvcrt.dll_fputc
test eax, eax
jne 0x140011a47
add ebx, 1
test ebx, ebx
jns 0x140011a47
movsxd rax, ebx
cmp byte [rax + 0x10], 0
je 0x140011acd
lea r8d, [rbx + 0x10]
mov rdx, rbp
mov rcx, rdi
movsxd r8, r8d
call fcn.14000d960
test eax, eax
jle 0x140011a47
add ebx, eax
jmp 0x140011ac0
Function at 0x140014700
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001b850
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001b850
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140015332
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14007c1a8]
test eax, eax
je 0x1400153ca
lea rax, [0x14007c180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14007c1b0]
mov qword [rbp - 8], rax
jmp 0x1400153ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400153a2
cmp qword [rbp - 0x10], 0
je 0x1400153a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140015368
lea rax, [0x14007c180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400153cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400154d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400154f8
mov eax, 0
jmp 0x140015546
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140015521
mov eax, 0
jmp 0x140015546
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140015541
mov eax, 0
jmp 0x140015546
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14001554c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400155ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400155c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400155c1
mov rax, qword [rbp - 8]
jmp 0x1400155df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015594
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400041b4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140004047
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004047
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004047
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004047
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004047
cmp dword [rcx + 0x84], 0xe
jbe 0x140004047
cmp dword [rcx + 0xf8], 0
je 0x140004047
mov ecx, ebx
call fcn.1400040e8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140003ed8
cmp dword [rbp + 0x20], 0
je 0x140004094
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000409c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140003fe0
Function at 0x140069cc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140069d7d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140069d7d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x2ac0eec6
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140069d78
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140069d40
cmp r10d, 0x41b27409
je 0x140069d85
test r11d, r11d
jne 0x140069d20
mov rax, qword [rax]
jmp 0x140069cf0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x140069dc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140069e7d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140069e7d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xb3242d18
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140069e78
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140069e40
cmp r10d, 0xb45a04a3
je 0x140069e85
test r11d, r11d
jne 0x140069e20
mov rax, qword [rax]
jmp 0x140069df0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x14007b3d0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
movzx eax, dl
mov r15, rcx
xor al, 1
mov byte [rcx + 0x4e], al
test dl, dl
je 0x14007b3f8
mov ebp, dword [rcx + 0x50]
jmp 0x14007b3fa
xor ebp, ebp
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14007b49d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14007b49d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xb1edb972
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x14007b498
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x14007b460
cmp r10d, 0x8a1b6ef7
je 0x14007b4a5
test r11d, r11d
jne 0x14007b440
mov rax, qword [rax]
jmp 0x14007b410
mov ecx, dword [rsi + 0x24]
mov edx, ebp
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
mov rcx, qword [r15]
add rax, rbx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop rdi
jmp rax
Function at 0x14007dcd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14007dcf4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14007dd82
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14007dd50
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x14007dd50
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1402f8260
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14007dd6d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14007dd75
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x14007dd11
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x14007de60
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x14007dd99
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14007dd9b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14007ddcd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1402f8260
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14007de5d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14007de08
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14007de3e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1402cec24
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14007de5d
cmp rsi, rax
ja 0x14007de11
test rsi, rsi
je 0x14007de5d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1402cec24
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x14007de80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x14007df21
mov rdi, r8
test r8, r8
jle 0x14007df19
lea rsi, [rcx + 0x58]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14007def3
mov rax, qword [rsi]
movsxd rdx, dword [rax]
test edx, edx
jle 0x14007def3
cmp rdi, rdx
mov rbp, rdi
cmovge rbp, rdx
mov rdx, r15
mov r8, rbp
call fcn.1402f8260
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x40]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14007df11
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, byte [r15]
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007df19
dec rdi
lea rsi, [rbx + 0x58]
mov ebp, 1
add r15, rbp
test rdi, rdi
jg 0x14007deb4
sub r14, rdi
mov rax, r14
jmp 0x14007df98
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x14007df38
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14007df3a
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14007df92
test ecx, ecx
jle 0x14007df73
cmp r14, rdi
mov rcx, r9
cmovl rdi, r14
mov r8, rdi
call fcn.1402f8260
mov rax, qword [rbx + 0x58]
add r15, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x40]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14007df92
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14007df92
mov r8, r14
mov edx, 1
mov rcx, r15
call fcn.1402ce028
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14007ecf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140345140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14007ed1d
xor eax, eax
jmp 0x14007ee6b
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14007ed57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14007ed57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14007ee6b
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14007ee5e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14007ed9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14007eda9
movsx ecx, dil
jmp 0x14007edfd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x14007ee17
sub eax, 1
je 0x14007ee17
cmp eax, 2
jne 0x14007ee5e
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1402ce0c4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14007ee63
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14007ee44
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1402ce028
cmp rsi, rax
jne 0x14007ee5e
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14007ee63
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402c69a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14008bce0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140345140]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
lea rax, vtable.sw::templates::basic_sha512_char_.0
mov qword [rsp + 0x30], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x40], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x48], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x50], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x58], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x60], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x68], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x70], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x84]
call fcn.1402f89a0
nop
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14008c4c0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14008bf90
nop
mov rax, rsi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402c69a0
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a5490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140345140]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x3c]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, 0xffffffffffffffff
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400a5571
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x1400a550b
mov byte [rbx], 0xc3
mov eax, dword [rsp + 0x3c]
mov r8d, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x140
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400a5571
call rbx
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, 1
jmp 0x1400a5573
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402c69a0
add rsp, 0x80
pop rbx
ret
Function at 0x1400ad7d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
xor r8d, r8d
lea rdx, [0x140325e6c]
mov rcx, rbx
call fcn.14008b070
mov dword [rsp + 0x20], 1
mov rcx, qword [0x140345cc0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400ad875
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400ad86f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400ad866
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ad850
mov rdx, rax
mov rcx, rbx
call fcn.14008b4e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400df830
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r15, qword [rcx + 0x18]
test r15, r15
je 0x1400df921
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1400df8fc
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1400df8fc
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
mov r10d, 0xca4d1ea6
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1400df8f7
nop
movsx edx, r9b
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx r9d, byte [rcx]
lea rcx, [rcx + 1]
test r9b, r9b
jne 0x1400df8c0
cmp r10d, 0xe53785fc
je 0x1400df904
test r11d, r11d
jne 0x1400df8a0
mov rax, qword [rax]
jmp 0x1400df870
mov edx, dword [rsi + 0x24]
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
add rax, rbx
mov rcx, r15
call rax
lea rcx, [rbp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14008b180