joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140136880
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1401bb090]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1401368a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1401368a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1401368a0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1401368f0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1401368e7
test rcx, rcx
je 0x1401368a0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1401368d8
xor eax, eax
ret

Function at 0x140136900
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401bb090]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14013691f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140136928
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140136940
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401bb090]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140136960
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140136968
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140136960
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140136960
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1401369b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1401369c0
add rdx, 0x28
cmp r9, rdx
jne 0x1401369a0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1401369d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1401bb090]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1401369f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140136a00
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401369f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1401369f2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1401369f2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140136a55
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140136a68
add rdx, 0x28
cmp rdx, r10
jne 0x140136a40
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140136a77
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140136a87
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140136a5e
test ecx, ecx
jg 0x140136a70
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140003c30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140003c53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x39]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x140003c40
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140003c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140003c94
mov ecx, esi
lea eax, [rcx - 0x39]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140003c80
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140003cc9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006a10
nop
cmp byte [rbx + 0xa], 0
je 0x140003cf3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x39]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140003ce0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140003d28
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140008cb0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003d7c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003dbc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003db7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003db7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140003e04
mov ecx, esi
lea eax, [rcx - 0x39]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140003df0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003e39
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140006a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003e47
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140009b70
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003ebc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003eb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140003f04
mov ecx, esi
lea eax, [rcx - 0x39]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140003ef0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003f39
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140006a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003f47
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140009b70
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003fbc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003fd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140003ff8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x39]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140003fe0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140004030
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140004064
mov ecx, esi
lea eax, [rcx - 0x39]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140004050
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004099
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140006a10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400040a7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140009b70
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000411c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004117
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004117
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004670
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400046a4
mov ecx, esi
lea eax, [rcx - 0x39]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004690
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x1400046d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140006a10
nop
cmp byte [rbx + 0xd], 0
je 0x140004703
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x39]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x1400046f0
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004738
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140006a10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.140008cb0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000478c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004786
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004786
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400047cc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a979c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004d80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140004da8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140004dce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140004dd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140004e29
test ecx, ecx
jle 0x140004e09
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140004e29
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140004e29
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140004e50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140004e72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140004e88
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140004ea4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004ea6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004ee2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140004f7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140004f1d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140004f5e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140004f7e
cmp rbx, rax
ja 0x140004f30
test rbx, rbx
je 0x140004f7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400053d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140111240]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400053fd
xor eax, eax
jmp 0x14000555a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140005428
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140005428
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000555a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000554d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000546b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005496
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005552
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005505
sub eax, 1
je 0x140005505
cmp eax, 2
jne 0x14000554d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005552
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005533
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000554d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005552
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a9be0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140005f70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140111240]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006043
cmp byte [rcx + 0x71], 0
je 0x140006043
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000603f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006004
sub eax, 1
je 0x140006008
cmp eax, 2
jne 0x14000603f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a9be0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006036
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000603f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140005fec
xor al, al
jmp 0x140005fec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a9be0
add rsp, 0x60
pop rbx
ret
Function at 0x14001a9e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140111240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140111720]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x14001aa47
cmp byte [rbx + 0x20d6], 0
jne 0x14001aa47
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140027cc0
test sil, 1
je 0x14001ab7c
jmp 0x14001aae6
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ae8e0]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400ae8d8]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140111720]
mulss xmm0, dword [0x1400ae86c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140027cc0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001ab36
lea r11, [0x1400adca0]
cmp r9b, 0x23
jne 0x14001ab19
cmp byte [r8], r9b
jne 0x14001ab19
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001ab06
not ecx
call fcn.1400266e0
test rax, rax
je 0x14001ab7c
cmp byte [rax + 0xcf], 0
je 0x14001ab7c
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140027cc0
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140016c50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a9be0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001e8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov rbp, rdx
mov qword [rsp + 0x28], rdi
mov rbx, rcx
mov rcx, qword [rdx + 0x448]
movzx edi, r8b
mov qword [rsp + 0x20], r14
test rcx, rcx
je 0x14001e923
xor r8d, r8d
call fcn.1400203b0
cmp qword [rbx + 0x80], 0
jne 0x14001e95c
cmp dword [rbx + 0x28], 1
jne 0x14001e95c
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax]
cmp byte [rcx + 0xd0], 0
jne 0x14001e95c
cmp byte [rcx + 0xcf], 0
mov byte [rcx + 0xd6], 1
sete al
inc al
mov byte [rcx + 0xf0], al
mov r8d, dword [rbx + 0x28]
mov ecx, dword [rbx + 0x2c]
cmp r8d, ecx
jne 0x14001e992
inc r8d
test ecx, ecx
je 0x14001e97a
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001e97f
mov eax, 8
cmp eax, r8d
lea rcx, [rbx + 0x28]
cmovg r8d, eax
mov edx, r8d
call fcn.140038180
movsxd rcx, dword [rbx + 0x28]
mov rax, qword [rbx + 0x30]
mov qword [rax + rcx*8], rbp
inc dword [rbx + 0x28]
or byte [rbx + 0xbc], 0x80
mov qword [rbp + 0x448], rbx
mov eax, dword [rbx]
mov dword [rbp + 0x458], eax
cmp dword [rbx + 0x28], 1
movzx eax, byte [rbp + 0x429]
setg cl
and al, 0xfe
or cl, al
and cl, 0xfb
mov byte [rbp + 0x429], cl
cmp qword [rbx + 0x80], 0
jne 0x14001ea28
cmp qword [rbx + 0x10], 0
jne 0x14001ea28
test dword [rbx + 8], 0x400
jne 0x14001ea28
mov eax, dword [rbx + 0xb8]
test al, 7
jne 0x14001ea02
and eax, 0xfffffffa
or eax, 2
mov dword [rbx + 0xb8], eax
test al, 0x38
jne 0x14001ea12
and eax, 0xffffffd7
or eax, 0x10
mov dword [rbx + 0xb8], eax
test eax, 0x1c0
jne 0x14001ea28
and eax, 0xfffffebf
bts eax, 7
mov dword [rbx + 0xb8], eax
test dil, dil
je 0x14001eaa8
cmp qword [rbx + 0x38], 0
jne 0x14001ea97
mov rcx, rbx
call fcn.14001e880
mov rcx, qword [rbx + 0x38]
xor edi, edi
mov eax, dword [rbx + 0xb0]
mov dword [rcx + 0x1c], eax
mov rcx, qword [rbx + 0x38]
mov eax, dword [rcx + 0x1c]
mov dword [rcx + 0x18], eax
mov eax, dword [rbx + 0x28]
dec eax
test eax, eax
jle 0x14001ea97
mov qword [rsp + 0x58], rsi
mov esi, edi
nop word [rax + rax]
mov r8, qword [rbx + 0x30]
xor edx, edx
mov rcx, qword [rbx + 0x38]
mov r8, qword [rsi + r8]
call fcn.140054f40
mov eax, dword [rbx + 0x28]
lea rsi, [rsi + 8]
dec eax
inc edi
cmp edi, eax
jl 0x14001ea70
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x38]
mov r8, rbp
mov edx, 0x400000
call fcn.140054f40
mov ecx, dword [rbx + 8]
mov eax, ecx
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
shr eax, 0xb
shr ecx, 0xa
cmp qword [rbx + 0x10], 0
movzx eax, al
movzx r8d, cl
cmovne r8d, eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001eae3
test byte [rax + 0xbc], 1
je 0x14001eae3
mov al, 1
jmp 0x14001eae5
xor al, al
cmp dword [rbx + 0x28], 0
movzx edx, al
mov eax, 1
cmovg edx, eax
mov rax, qword [rbx + 0x20]
or dl, r8b
test rax, rax
je 0x14001eb0d
test byte [rax + 0xbc], 1
je 0x14001eb0d
mov cl, 1
jmp 0x14001eb0f
xor cl, cl
movzx eax, byte [rbx + 0xbc]
or cl, dl
mov r8, qword [rbx + 0x80]
and cl, 1
and al, 0xfe
xor cl, al
mov byte [rbx + 0xbc], cl
mov rbx, qword [rsp + 0x50]
test r8, r8
je 0x14001eb4a
mov edx, dword [rbp + 0xc]
mov rcx, rbp
bts edx, 0x18
add rsp, 0x30
pop rbp
jmp fcn.140037000
add rsp, 0x30
pop rbp
ret