joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400074c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x14000a7f8]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1400074fc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140006180
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400075b8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000761e
test ebx, ebx
jne 0x14000761e
lea ecx, [rax + 2]
call fcn.140006180
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140005990
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140001140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400610c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x130]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ecx, ecx
call fcn.140001080
mov ecx, eax
call fcn.14001aaf8
call fcn.14001aacc
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.1400013b0
mov rcx, rax
call fcn.14000ec50
mov qword [rsp + 0x70], rax
mov edx, dword [rsp + 0x28]
lea rcx, [rsp + 0x110]
call fcn.1400104e0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x21]
call fcn.140001330
mov rcx, rax
call fcn.14000ebb0
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xf0]
call fcn.14000ad80
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov r8, rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xd0]
call fcn.1400092f0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.1400092a0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
mov r8, rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x90]
call fcn.1400092f0
nop
lea rcx, [rsp + 0xb0]
call fcn.14000c1c0
nop
lea rcx, [rsp + 0xd0]
call fcn.14000c1c0
nop
lea rcx, [rsp + 0xf0]
call fcn.14000c1c0
nop
lea rcx, [rsp + 0x110]
call fcn.14000c1c0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x260]
call fcn.14000acb0
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x90]
call fcn.14000c1c0
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140012390
add rsp, 0x250
pop rdi
ret

Function at 0x1400014b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
mov rcx, qword [rsp + 0xf0]
call fcn.14000e840
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xe0
pop rdi
ret
Function at 0x140022374
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140012330
sub rsp, rax
mov rax, qword [0x1400610c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140020ce0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400223c3
mov rax, rbp
jmp 0x1400224cb
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x633e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140023494
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x633e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400224c7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400224c7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140023494
test rax, rax
js 0x1400224c7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400224c7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400224b9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400224b9
cmp byte [rcx], 0xd
jne 0x14002249f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400224ae
cmp byte [rcx + 1], 0xa
jne 0x1400224ae
inc rcx
jmp 0x1400224ae
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x61500]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140022481
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400224cb
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140012390
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400226ec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140022702
mov al, 1
jmp 0x140022762
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140022713
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140022760
mov ecx, dword [rcx + 0x18]
nop
call fcn.140027d14
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140022760
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140022760
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140022760
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140022762
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140022834
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400633e0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14002288b
cmp word [rdx], r13w
jne 0x14002288b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140022890
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400229b5
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400229d6
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400228c9
mov rdx, r9
mov word [rbx], cx
jmp 0x1400228f0
cmp r9, r8
jae 0x140022900
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400228aa
jmp 0x1400229b5
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400229aa
cmp dword [rsp + 0x80], esi
je 0x1400229aa
lea r8, [0x1400633e0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140022982
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140022952
mov word [rbx], r13w
jmp 0x1400229b2
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14002295f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400229b2
cmp word [rsp + 0x70], r13w
jne 0x14002298f
cmp rbx, r14
je 0x14002294c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14002349c
cmp word [rsp + 0x70], r13w
je 0x1400229b5
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400633e0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400229af
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400229b5
Function at 0x140001d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r9, rcx
mov eax, dword [0x1406dec90]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406dec94], 0xa
setl al
or al, cl
nop dword [rax + rax]
test al, al
je 0x140001d70
movzx r10d, byte [rdx]
mov rcx, r10
shr rcx, 3
lea rbp, [0x140250400]
mov eax, 0x80ff0000
shr rax, cl
movsx r11, byte [rcx + rbp]
and eax, 1
add rax, r11
lea rcx, [rdx + rax]
test r8, r8
cmovne rcx, r8
xor r8d, r8d
cmp rcx, rdx
cmovbe r10d, r8d
lea rsi, [rdx + 1]
cmp rsi, rcx
jae 0x140001dba
mov r8b, byte [rsi]
lea rsi, [rdx + 2]
cmp rsi, rcx
jae 0x140001dc8
mov r14b, byte [rsi]
jmp 0x140001dcb
xor r14d, r14d
add rdx, 3
cmp rdx, rcx
jae 0x140001dd8
mov cl, byte [rdx]
jmp 0x140001dda
xor ecx, ecx
movzx edx, r10b
lea rdi, [0x140250420]
and edx, dword [rdi + r11*4]
shl edx, 0x12
movzx edi, r8b
mov ebp, edi
and ebp, 0x3f
shl ebp, 0xc
or ebp, edx
movzx ebx, r14b
mov esi, ebx
and esi, 0x3f
shl esi, 6
or esi, ebp
movzx r15d, cl
mov ebp, r15d
and ebp, 0x3f
or ebp, esi
lea rcx, [0x140250460]
mov cl, byte [rcx + r11*4]
shr ebp, cl
mov dword [r9], ebp
cmp dword [0x1406dec94], 0xa
jl 0x140001e5d
mov ecx, dword [0x1406dec90]
lea esi, [rcx - 1]
imul esi, ecx
and esi, 1
je 0x140001e5d
nop
mov dword [r9], ebp
cmp dword [0x1406dec94], 0xa
jl 0x140001e5d
mov ecx, dword [0x1406dec90]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x140001e40
xor ecx, ecx
cmp ebp, 0x10000
setae cl
shl ecx, 8
mov esi, ebp
and esi, 0xfffff800
xor edx, edx
cmp esi, 0xd800
sete dl
shl edx, 7
lea r12, [0x140250440]
xor esi, esi
cmp ebp, dword [r12 + r11*4]
setb sil
shl esi, 6
shr edi, 2
and edi, 0xfffffff0
shr ebx, 6
mov ebp, r15d
shr ebp, 6
lea edi, [rdi + rbx*4]
or edi, ebp
or edi, ecx
or edi, edx
or edi, esi
xor edi, 0x2a
lea rcx, [0x140250480]
mov cl, byte [rcx + r11*4]
sar edi, cl
test edi, edi
je 0x140001eee
xor ecx, ecx
test r10b, r10b
setne cl
cmp r8b, 1
sbb ecx, 0xffffffff
cmp r14b, 1
sbb ecx, 0xffffffff
cmp r15d, 1
sbb ecx, 0xffffffff
cmp eax, ecx
cmovl ecx, eax
mov dword [r9], 0xfffd
mov eax, ecx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140003210
Capabilities:
Hash data with crc32

Disassembly:
push rsi
not r8d
test rdx, rdx
je 0x14000328e
mov eax, dword [0x1406ded50]
lea esi, [rax - 1]
imul esi, eax
test sil, 1
sete al
cmp dword [0x1406ded54], 0xa
setl r9b
or r9b, al
lea r10, section..rdata
mov eax, r8d
jmp 0x14000325d
movzx esi, al
shr eax, 8
xor esi, r11d
xor eax, dword [r10 + rsi*4]
mov rsi, rcx
test r9b, r9b
je 0x140003260
sub rdx, 1
jb 0x1400032d0
lea rcx, [rsi + 1]
movzx r11d, byte [rsi]
cmp r11d, 0x23
jne 0x140003250
cmp rdx, 2
jb 0x140003250
cmp byte [rcx], 0x23
jne 0x140003250
cmp byte [rsi + 2], 0x23
cmove eax, r8d
jmp 0x140003250
add rcx, 2
lea r9, section..rdata
mov eax, r8d
jmp 0x1400032b4
movzx esi, al
shr eax, 8
xor esi, edx
xor eax, dword [r9 + rsi*4]
add rcx, 1
test edx, edx
je 0x1400032d0
movzx edx, byte [rcx - 2]
test edx, edx
je 0x1400032ac
cmp dl, 0x23
jne 0x1400032a0
cmp byte [rcx - 1], 0x23
jne 0x1400032a0
cmp byte [rcx], 0x23
cmove eax, r8d
jmp 0x1400032a0
not eax
pop rsi
ret
Function at 0x140008560
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r15, rdx
mov eax, dword [rcx + 0xd0]
add eax, 0xffffffff
mov rcx, qword [rcx + 0xd8]
cdqe
mov r8d, dword [rcx + rax*4]
not r8d
test r14, r14
je 0x14000860f
mov rcx, r14
sub rcx, r15
je 0x14000860f
mov eax, dword [0x1406ded50]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1406ded54], 0xa
setl dl
or dl, al
lea r9, section..rdata
mov rax, r15
mov ebx, r8d
jmp 0x1400085dc
movzx edi, bl
shr ebx, 8
xor edi, esi
xor ebx, dword [r9 + rdi*4]
mov rdi, rax
nop
test dl, dl
je 0x1400085e0
sub rcx, 1
jb 0x14000866a
lea rax, [rdi + 1]
movzx esi, byte [rdi]
cmp esi, 0x23
jne 0x1400085d0
cmp rcx, 2
jb 0x1400085d0
cmp byte [rax], 0x23
jne 0x1400085d0
cmp byte [rdi + 2], 0x23
cmove ebx, r8d
jmp 0x1400085d0
mov dl, byte [r15]
test dl, dl
je 0x140008667
lea rax, [r15 + 2]
lea r9, section..rdata
mov edi, r8d
jmp 0x14000864e
movzx edx, dl
mov ebx, edi
shr ebx, 8
movzx edi, dil
xor edi, edx
xor ebx, dword [r9 + rdi*4]
add rax, 1
mov edx, ecx
mov edi, ebx
test cl, cl
je 0x14000866a
movzx ecx, byte [rax - 1]
cmp dl, 0x23
jne 0x140008630
cmp cl, 0x23
jne 0x140008630
cmp byte [rax], 0x23
cmove edi, r8d
mov cl, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140008630
mov ebx, r8d
not ebx
mov rax, qword [0x1406deb70]
cmp dword [rax + 0x3edc], ebx
jne 0x1400086c0
nop dword [rax + rax]
mov ecx, ebx
mov edx, ntohl
mov r8, r15
mov r9, r14
call fcn.1400091c0
cmp dword [0x1406df008], 0xa
jl 0x1400086c0
mov eax, dword [0x1406df00c]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400086c0
mov ecx, ebx
mov edx, ntohl
mov r8, r15
mov r9, r14
call fcn.1400091c0
jmp 0x140008680
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140009690
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1406df030]
lea esi, [rax - 1]
imul esi, eax
test sil, 1
sete al
cmp dword [0x1406df034], 0xa
setl r8b
or r8b, al
mov eax, dword [0x1406ded48]
lea esi, [rax - 1]
imul esi, eax
test sil, 1
sete r9b
cmp dword [0x1406ded4c], 0xa
setl al
or al, r9b
jmp 0x1400096e5
test r8b, r8b
jne 0x1400096fa
test al, al
jne 0x1400096e0
xor esi, esi
nop dword [rax + rax]
test sil, 1
mov esi, eax
je 0x1400096f0
jmp 0x1400096e0
mov rax, qword [rcx + 0xd8]
mov ecx, dword [rcx + 0xd0]
add ecx, 0xffffffff
movsxd rcx, ecx
mov eax, dword [rax + rcx*4]
not eax
mov esi, edx
shr esi, 8
mov r9d, edx
shr r9d, 0x10
mov r8d, edx
mov ecx, eax
shr ecx, 8
xor eax, edx
movzx eax, al
lea r10, section..rdata
xor ecx, dword [r10 + rax*4]
shr r8d, 0x18
mov eax, ecx
shr eax, 8
xor ecx, esi
movzx ecx, cl
xor eax, dword [r10 + rcx*4]
mov esi, eax
shr esi, 8
xor eax, r9d
movzx eax, al
xor esi, dword [r10 + rax*4]
movzx eax, sil
shr esi, 8
xor eax, r8d
xor esi, dword [r10 + rax*4]
not esi
mov rax, qword [0x1406deb70]
cmp dword [rax + 0x3edc], esi
jne 0x140009788
movsxd r8, edx
mov ecx, esi
mov edx, 4
xor r9d, r9d
call fcn.1400091c0
mov eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140009790
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
mov r8d, dword [0x1406df038]
lea eax, [r8 - 1]
imul eax, r8d
test al, 1
sete al
cmp dword [0x1406df03c], 0xa
setl r9b
or r9b, al
nop word cs:[rax + rax]
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r8, rsp
test r9b, r9b
je 0x1400097c0
mov r9, qword [rcx + 0xd8]
mov eax, dword [rcx + 0xd0]
add eax, 0xffffffff
cdqe
mov eax, dword [r9 + rax*4]
movsd xmm0, qword [rcx + 0xf0]
cmp dword [0x1406df040], 0xa
jl 0x140009812
mov r9d, dword [0x1406df044]
lea ecx, [r9 - 1]
imul ecx, r9d
and ecx, 1
je 0x140009812
jmp 0x140009810
movups xmm1, xmmword [rdx]
cmp dword [0x1406dee68], 0xa
jl 0x140009832
mov ecx, dword [0x1406dee6c]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140009832
nop
jmp 0x140009830
cmp dword [0x1406dec10], 0xa
jl 0x140009852
mov ecx, dword [0x1406dec14]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140009852
nop dword [rax]
jmp 0x140009850
movlhps xmm0, xmm0
subps xmm1, xmm0
movaps xmmword [r8], xmm1
not eax
mov ecx, dword [0x1406ded48]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x1406ded4c], 0xa
setl cl
or cl, dl
mov r11d, reloc.WS2_32.dll_recv
lea r9, section..rdata
nop dword [rax]
test cl, cl
je 0x140009890
sub r11, 1
jb 0x1400098b2
movzx r10d, al
shr eax, 8
movzx edx, byte [r8]
add r8, 1
xor edx, r10d
xor eax, dword [r9 + rdx*4]
jmp 0x140009890
not eax
mov rsp, rbp
pop rbp
ret
Function at 0x14001d260
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1406de900]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x1406deb70]
mov dword [rax + 0x537c], 0
test rcx, rcx
je 0x14001d32c
mov rdi, rcx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.14002b7e0
mov rsi, rax
lea rdx, [0x14026c2fc]
mov rcx, rdi
call fcn.1400032e0
test rax, rax
je 0x14001d32c
mov rdi, rax
mov rbx, qword [rsp + 0x20]
cmp dword [0x1406ded60], 0xa
jl 0x14001d2df
mov eax, dword [0x1406ded64]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14001d30d
mov edx, 1
mov rcx, rsi
mov r8, rbx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1406ded60], 0xa
jl 0x14001d323
mov eax, dword [0x1406ded64]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14001d323
mov edx, 1
mov rcx, rsi
mov r8, rbx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14001d2df
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401fc630
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140021300
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
mov al, byte [rcx]
test al, al
je 0x14002135a
add rcx, 2
mov r8d, 0xffffffff
lea r9, section..rdata
mov edx, 0xffffffff
jmp 0x14002133b
movzx eax, al
movzx edi, dl
shr edx, 8
xor edi, eax
xor edx, dword [r9 + rdi*4]
add rcx, 1
mov eax, r10d
test r10b, r10b
je 0x140021356
movzx r10d, byte [rcx - 1]
cmp al, 0x23
jne 0x140021320
cmp r10b, 0x23
jne 0x140021320
cmp byte [rcx], 0x23
cmove edx, r8d
mov r10b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140021320
not edx
jmp 0x14002135c
xor edx, edx
mov eax, dword [0x1406df588]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406df58c], 0xa
setl r8b
or r8b, al
mov rax, qword [0x1406deb70]
mov ecx, dword [0x1406df438]
lea edi, [rcx - 1]
imul edi, ecx
test dil, 1
sete cl
cmp dword [0x1406df43c], 0xa
setl r9b
or r9b, cl
mov r10, qword [rax + 0x3e90]
movsxd r11, dword [rax + 0x3e88]
jmp 0x1400213c7
xor eax, eax
test r9b, r9b
jne 0x14002143e
test r11d, r11d
je 0x140021420
mov rax, r10
mov rsi, r11
mov rcx, r11
jmp 0x1400213e8
mov rsi, rcx
test rcx, rcx
je 0x140021410
shr rcx, 1
mov rdi, rcx
shl rdi, 4
cmp dword [rax + rdi], edx
jae 0x1400213e0
not rcx
add rcx, rsi
add rax, rdi
add rax, 0x10
jmp 0x1400213e0
mov rcx, r11
jmp 0x140021425
xor ecx, ecx
mov rax, r10
shl rcx, 4
add rcx, r10
cmp rax, rcx
je 0x1400213c0
cmp dword [rax], edx
jne 0x1400213c0
mov rax, qword [rax + 8]
test r9b, r9b
je 0x1400213c7
test r8b, r8b
je 0x1400213c7
pop rdi
pop rsi
ret
Function at 0x14002ad20
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov eax, dword [0x1406df8c0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1406df8c4], 0xa
setl al
or al, cl
test al, al
je 0x14002ad50
lea rbx, [r14 + 0x53e8]
cmp qword [r14 + 0x53e0], 0
je 0x14002ae3f
mov eax, dword [r14 + 0x53ec]
test eax, eax
jns 0x14002adbc
mov ecx, dword [0x1406dec50]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp dword [0x1406dec54], 0xa
setl cl
or cl, dl
nop word cs:[rax + rax]
nop dword [rax]
test cl, cl
je 0x14002ada0
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
xor ecx, ecx
add edx, eax
cmovs edx, ecx
mov rcx, rbx
call fcn.140004800
mov dword [r14 + 0x53e8], 0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140004990
mov rsi, qword [r14 + 0x53e0]
mov eax, dword [r14 + 0x53e8]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd rdi, eax
mov rax, qword [r14 + 0x53f0]
test rax, rax
lea rbx, [0x1406deb78]
cmovne rbx, rax
cmp dword [0x1406ded60], 0xa
jl 0x14002ae58
mov eax, dword [0x1406ded64]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14002ae86
jmp 0x14002ae58
mov eax, dword [0x1406df8c0]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14002ae9c
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140004990
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140004990
cmp dword [0x1406df8c4], 0xa
jge 0x14002ae20
jmp 0x14002ae9c
mov edx, 1
mov rcx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1406ded60], 0xa
jl 0x14002ae9c
mov eax, dword [0x1406ded64]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14002ae9c
mov edx, 1
mov rcx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14002ae58
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret