joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005fc90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14005fefa
mov rdi, rax
cmp rax, 0xf
ja 0x14005fcf4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsp
add rdi, 0x20
jmp 0x14005fd55
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, reloc.WS2_32.dll_shutdown
cmovae r15, rax
cmp r15, 0xfff
jb 0x14005fd29
lea rcx, [r15 + 0x28]
call fcn.1400f0b5c
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14005fd35
lea rcx, [r15 + 1]
call fcn.1400f0b5c
mov r14, rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
cmp r15, 0x10
lea r14, [rsp + 0x20]
cmovae r14, rdi
test rbx, rbx
je 0x14005fd9c
mov eax, ebx
and eax, 3
movabs rcx, 0x100000001b3
cmp rbx, 4
jae 0x14005fdab
movabs r8, 0xcbf29ce484222325
xor edx, edx
jmp 0x14005fdfc
movabs r9, 0xcbf29ce484222325
jmp 0x14005fe27
mov r9, rbx
and r9, 0xfffffffffffffffc
movabs r8, 0xcbf29ce484222325
xor edx, edx
nop
movzx r10d, byte [r14 + rdx]
xor r10, r8
imul r10, rcx
movzx r8d, byte [r14 + rdx + 1]
xor r8, r10
imul r8, rcx
movzx r10d, byte [r14 + rdx + 2]
xor r10, r8
imul r10, rcx
movzx r8d, byte [r14 + rdx + 3]
xor r8, r10
imul r8, rcx
add rdx, 4
cmp r9, rdx
jne 0x14005fdc0
mov r9, r8
test rax, rax
je 0x14005fe27
add rdx, r14
xor r10d, r10d
nop word [rax + rax]
movzx r9d, byte [rdx + r10]
xor r9, r8
imul r9, rcx
inc r10
mov r8, r9
cmp rax, r10
jne 0x14005fe10
and r9, qword [rsi + 0x30]
mov r13, qword [rsi + 8]
mov rax, qword [rsi + 0x18]
mov rcx, r9
shl rcx, 4
mov r12, qword [rax + rcx + 8]
cmp r12, r13
je 0x14005fe97
add r9, r9
mov rbp, qword [rax + r9*8]
cmp rbx, qword [r12 + 0x20]
jne 0x14005fe84
nop word cs:[rax + rax]
cmp qword [r12 + 0x28], 0x10
jb 0x14005fe70
mov rdx, qword [r12 + 0x10]
jmp 0x14005fe75
lea rdx, [r12 + 0x10]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005fe9a
cmp r12, rbp
je 0x14005fe97
mov r12, qword [r12 + 8]
cmp rbx, qword [r12 + 0x20]
je 0x14005fe60
jmp 0x14005fe84
xor r12d, r12d
test r12, r12
cmove r12, r13
cmp r15, 0x10
jb 0x14005fedb
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x14005fecf
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14005feff
add r15, 0x28
mov rdx, r15
mov rdi, rax
mov rcx, rdi
call fcn.1400f0ba0
mov r13, qword [rsi + 8]
cmp r12, r13
je 0x14005fee7
mov eax, dword [r12 + 0x30]
jmp 0x14005fee9
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001c100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140076b40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov qword [rcx + 0x20], rdx
cmp dword [rcx + 0x38], 0
je 0x140076c00
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x28]
sub rdi, rcx
add r8d, edi
jb 0x140076bb9
mov eax, dword [rsi + 0x30]
sub eax, ecx
cmp r8d, eax
jbe 0x140076b8b
nop word cs:[rax + rax]
test eax, eax
js 0x140076bb9
add eax, eax
cmp r8d, eax
ja 0x140076b80
mov ebx, eax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140076bb9
mov qword [rsi + 0x28], rax
mov ecx, edi
add rcx, rax
mov qword [rsi + 0x20], rcx
add rbx, rax
mov qword [rsi + 0x30], rbx
mov eax, 1
jmp 0x140076c91
cmp byte [0x140186241], 0
jne 0x140076be1
movabs rax, 0x6d656d666f74756f
mov qword [0x140186238], rax
mov byte [0x140186240], 0
mov byte [0x140186241], 1
mov eax, dword [0x14019f7f0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [0x140186238]
jmp 0x140076c88
cmp byte [0x140186856], 0
jne 0x140076c6e
xor eax, eax
lea rcx, [0x1401059a0]
lea rdx, [0x140186842]
nop dword [rax]
movzx r8d, byte [rax + rcx + 0x19b7]
xor r8b, byte [rax + rcx + 0x19ca]
lea r9, [rax + 1]
cmp rax, 0x12
mov r10d, 0
cmovne r10, r9
movzx r9d, byte [r10 + rcx + 0x19b7]
xor r9b, byte [rax + rcx + 0x19cb]
mov byte [rax + rdx], r8b
mov byte [rax + rdx + 1], r9b
add rax, 2
cmp rax, 0x14
jne 0x140076c20
mov byte [0x140186856], 1
mov eax, dword [0x14019f7f0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [0x140186842]
mov qword [rax + 8], rcx
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400778d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp byte [0x140186949], 0
jne 0x140077976
mov ecx, 1
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x1401059a0]
lea r11, [0x14018692f]
nop
mov rax, rcx
mul r9
mov rsi, rcx
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 4
mov rax, r8
mul r9
imul rax, rsi, 0xffffffffffffffe9
mov rsi, r8
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 4
imul rdx, rsi, 0xffffffffffffffe9
lea rsi, [r10 + r8]
movzx edx, byte [rdx + rsi + 0x1c68]
xor dl, byte [r8 + r10 + 0x1c7f]
mov byte [r8 + r11], dl
movzx eax, byte [rax + rsi + 0x1c69]
xor al, byte [r8 + r10 + 0x1c80]
mov byte [r8 + r11 + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x1a
jne 0x140077900
mov byte [0x140186949], 1
pop rsi
ret
Function at 0x140082fe0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rdi, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x20], 0x130
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140083085
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x14008306d
lea r14, [rsp + 0x4c]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
lea r15, [rsp + 0x20]
nop word [rax + rax]
mov rcx, r14
mov rdx, rdi
call r12
test eax, eax
je 0x140083078
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x140083050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140083085
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400f0d70
mov eax, esi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400844e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x14008460d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14008453d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x14008453d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x140084652
cmp qword [rdi + 0x80], 0
je 0x140084611
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140084577
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140084618
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x140084631
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x1400845fd
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x140084650
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x14008464b
xor esi, esi
jmp 0x140084652
mov esi, 0xffffffff
jmp 0x140084652
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x140084652
cmp eax, 3
jne 0x140084650
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f0d70
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140084ac0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140084afb
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140084b02
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x140084bf9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140084b55
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140084b55
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140084b66
jmp 0x140084bf6
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140084bf6
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140084b92
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x140084bd1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140084ba0
jmp 0x140084bf6
test r14, r14
je 0x140084bf3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x140084bf6
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140084c10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140084c46
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140084c93
test rsi, rsi
jle 0x140084c93
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x140084c93
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x140084c9b
jmp 0x140084cbb
mov r14, rsi
test r14, r14
jle 0x140084cbb
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140084cbb
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400850b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14008515a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14008515a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140085158
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140085171
cmp eax, 1
je 0x140085127
test eax, eax
jne 0x140085158
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14008514e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140085158
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14008515a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f0d70
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14008515a

Function at 0x140086ce0
Capabilities:
Hash data with crc32

Disassembly:
not r8d
test rdx, rdx
je 0x140086d3e
dec rdx
add rcx, 2
lea r9, [0x140109410]
mov r10d, r8d
jmp 0x140086d21
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
add rdx, 0xffffffffffffffff
jae 0x140086d97
movzx eax, byte [rcx - 2]
cmp rdx, 2
jb 0x140086d00
cmp al, 0x23
jne 0x140086d00
cmp byte [rcx - 1], 0x23
jne 0x140086d00
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x140086d00
movzx edx, byte [rcx]
test dl, dl
je 0x140086d9a
add rcx, 2
lea r9, [0x140109410]
mov r10d, r8d
jmp 0x140086d7f
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
test dl, dl
je 0x140086d97
mov eax, edx
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x140086d60
cmp dl, 0x23
jne 0x140086d60
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x140086d60
not eax
ret
mov eax, r8d
not eax
ret
Function at 0x140087250
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, r9d
mov rdi, r8
test r8, r8
je 0x140087270
mov qword [rdi], 0
call fcn.140086da0
test rax, rax
je 0x1400872ab
mov rbx, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x1400872a2
mov esi, eax
mov rcx, rbx
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x1400872bf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x1400872a2
mov r14d, eax
xor r15d, r15d
mov rcx, rbx
mov edx, esi
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
neg eax
sbb r15d, r15d
or r15d, r14d
cmp r15d, 0xffffffff
je 0x1400872a2
movsxd r14, r15d
movsxd r15, ebp
lea r12, [r14 + r15]
mov rdx, qword [0x140186d60]
mov rcx, r12
call qword [0x14017f688]
mov rsi, rax
mov rax, qword [0x140186d50]
test rax, rax
je 0x1400873ab
mov ecx, dword [rax + 0x3fc0]
movsx rdx, word [rax + 0x6228]
cmp dword [rax + rdx*8 + 0x622c], ecx
jne 0x140087340
lea rdx, [rax + rdx*8]
add rdx, 0x622c
jmp 0x14008738d
inc edx
movsxd rdx, edx
imul r8, rdx, 0x2aaaaaab
mov r9, r8
shr r9, 0x3f
shr r8, 0x20
add r8d, r9d
add r8d, r8d
lea r8d, [r8 + r8*2]
sub edx, r8d
mov word [rax + 0x6228], dx
movsxd r8, edx
lea rdx, [rax + r8*8]
add rdx, 0x622c
mov dword [rax + r8*8 + 0x622c], ecx
mov dword [rax + r8*8 + 0x6230], 0
cmp r12, 0xffffffffffffffff
je 0x14008739f
add rax, 0x6220
inc word [rdx + 4]
jmp 0x1400873a9
inc word [rdx + 6]
add rax, 0x6224
inc dword [rax]
test rsi, rsi
je 0x1400872a2
mov edx, 1
mov rcx, rsi
mov r8, r14
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
jne 0x1400873fb
test ebp, ebp
jle 0x1400873e1
mov rcx, rsi
add rcx, r14
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400872ad
mov qword [rdi], r14
jmp 0x1400872ad
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140186d50]
test rax, rax
je 0x140087485
mov ecx, dword [rax + 0x3fc0]
movsx rdx, word [rax + 0x6228]
cmp dword [rax + rdx*8 + 0x622c], ecx
jne 0x140087433
movzx ecx, word [rax + rdx*8 + 0x6232]
inc ecx
jmp 0x140087477
inc edx
movsxd rdx, edx
imul r8, rdx, 0x2aaaaaab
mov r9, r8
shr r9, 0x3f
shr r8, 0x20
add r8d, r9d
add r8d, r8d
lea r8d, [r8 + r8*2]
sub edx, r8d
mov word [rax + 0x6228], dx
movsxd rdx, edx
mov dword [rax + rdx*8 + 0x622c], ecx
mov dword [rax + rdx*8 + 0x6230], 0
mov cx, 1
mov word [rax + rdx*8 + 0x6232], cx
inc dword [rax + 0x6224]
mov rdx, qword [0x140186d60]
mov rcx, rsi
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400872ab
Function at 0x14008e200
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, qword [0x140186d50]
mov dword [rdi + 0x609c], 0
test rcx, rcx
je 0x14008e30c
mov rsi, rcx
lea rbx, [rdi + 0x60a0]
xor ebp, ebp
mov rcx, rbx
xor edx, edx
call fcn.1400878c0
mov byte [rsp + 0x2f], 0
lea rdx, [rsp + 0x2f]
mov rcx, rbx
call fcn.1400a94e0
movsxd rax, dword [rdi + 0x60b0]
test rax, rax
je 0x14008e297
mov r14, qword [rdi + 0x60b8]
shl rax, 3
lea r15, [rax + rax*8]
nop dword [rax + rax]
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call qword [r14 + 0x38]
add r14, 0x48
add r15, 0xffffffffffffffb8
jne 0x14008e280
mov ebx, dword [rdi + 0x60a0]
sub ebx, 1
cmovb ebx, ebp
mov rax, qword [rdi + 0x60a8]
test rax, rax
lea rdi, [0x140186d58]
cmovne rdi, rax
cmp byte [0x140187dbe], 0
jne 0x14008e2d8
mov word [0x140187dbb], 0x7477
mov byte [0x140187dbd], 0
mov byte [0x140187dbe], 1
lea rdx, [0x140187dbb]
mov rcx, rsi
call fcn.140086da0
test rax, rax
je 0x14008e30c
mov rsi, rax
movsxd r8, ebx
mov edx, 1
mov rcx, rdi
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14008f660
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r9, r8
mov r8, rdx
mov rax, qword [rcx + 0x110]
movsxd rdx, dword [rcx + 0x108]
mov eax, dword [rax + rdx*4 - 4]
not eax
test r9, r9
je 0x14008f6ed
mov rdx, r9
sub rdx, r8
je 0x14008f6ed
mov rdx, r8
not rdx
add rdx, r9
lea r10, [r8 + 2]
lea r11, [0x140109410]
mov edi, eax
jmp 0x14008f6cd
movzx ebx, bl
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
inc r10
mov edi, esi
add rdx, 0xffffffffffffffff
jae 0x14008f747
movzx ebx, byte [r10 - 2]
cmp rdx, 2
jb 0x14008f6b0
cmp bl, 0x23
jne 0x14008f6b0
cmp byte [r10 - 1], 0x23
jne 0x14008f6b0
cmp byte [r10], 0x23
cmove edi, eax
jmp 0x14008f6b0
movzx edx, byte [r8]
test dl, dl
je 0x14008f745
lea r10, [r8 + 2]
lea r11, [0x140109410]
mov edi, eax
jmp 0x14008f72b
movzx ebx, bl
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
inc r10
mov edi, esi
test dl, dl
je 0x14008f747
mov ebx, edx
movzx edx, byte [r10 - 1]
cmp bl, 0x23
jne 0x14008f710
cmp dl, 0x23
jne 0x14008f710
cmp byte [r10], 0x23
cmove edi, eax
jmp 0x14008f710
mov esi, eax
not esi
mov rax, qword [rcx]
cmp dword [rax + 0x40cc], esi
jne 0x14008f760
mov ecx, esi
mov edx, recv
call fcn.1400a3d50
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400923c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, qword [0x140186d50]
mov rax, qword [rsi + 0x4098]
test rax, rax
je 0x14009248f
mov ecx, dword [rsi + 0x40e4]
mov edx, dword [rsi + 0x4114]
mov dword [rsi + 0x40e8], ecx
cmp edx, ecx
jne 0x140092408
mov byte [rsi + 0x4118], 1
cmp byte [rsi + 0x118], 0
je 0x140092469
movsd xmm0, qword [rsi + 0x110]
ucomiss xmm0, dword [0x1401150f0]
jb 0x140092469
movaps xmm1, xmm0
shufps xmm1, xmm0, 0x55
ucomiss xmm1, dword [0x1401150f0]
jb 0x140092469
mov rcx, qword [rax + 0x390]
movsd xmm1, qword [rsi + 0x40fc]
subps xmm0, xmm1
movlps qword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 1
call fcn.1400924e0
mov rcx, qword [rsi + 0x4098]
xor edx, edx
call fcn.140091d30
jmp 0x1400924c7
mov qword [rsi + 0x4098], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f0d70
xor ecx, ecx
xor edx, edx
add rsp, 0x30
pop rsi
jmp fcn.140090cb0
mov rax, qword [rsi + 0x4108]
test rax, rax
je 0x1400924c7
mov eax, dword [rax + 0x8c]
cmp eax, dword [rsi + 0x40e4]
jne 0x1400924c7
mov dword [rsi + 0x40e8], eax
cmp dword [rsi + 0x4114], eax
jne 0x1400924be
mov byte [rsi + 0x4118], 1
cmp byte [rsi + 0x118], 0
je 0x140092474
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x30
pop rsi
ret
Function at 0x14009fb80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, qword [0x140186d50]
cmp byte [rsi + 0x4dc4], 0
je 0x14009fc4f
test byte [rsi + 0x6184], 1
je 0x14009fc4f
cmp byte [0x140187c79], 0
jne 0x14009fc43
mov ecx, 1
xor r8d, r8d
movabs r10, 0xd79435e50d79435f
lea r11, [0x140109b30]
lea rdi, [0x140187c5d]
nop dword [rax]
mov rax, rcx
mul r10
mov r9, rdx
shr r9, 4
mov rax, r8
mul r10
imul rax, r9, 0xffffffffffffffed
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffed
lea r9, [r11 + r8]
movzx edx, byte [rdx + r9 + 0x2548]
xor dl, byte [r8 + r11 + 0x255b]
mov byte [r8 + rdi], dl
movzx eax, byte [rax + r9 + 0x2549]
xor al, byte [r8 + r11 + 0x255c]
mov byte [r8 + rdi + 1], al
add r8, 2
add rcx, 2
cmp r8, 0x1c
jne 0x14009fbe0
mov byte [0x140187c79], 1
lea rcx, [0x140187c5d]
call fcn.140086520
mov byte [rsi + 0x4dc4], 0
xorps xmm6, xmm6
movups xmmword [rsi + 0x4df0], xmm6
movups xmmword [rsi + 0x4e00], xmm6
mov byte [rsi + 0x4e10], 0
movups xmmword [rsi + 0x4dd8], xmm6
movabs rax, 0xffffffff00000000
mov qword [rsi + 0x4de8], rax
mov word [rsi + 0x4e11], 0
mov dword [rsi + 0x4e3c], 0
mov qword [rsi + 0x4e48], rax
mov qword [rsi + 0x4e40], 0x7f7fffff
mov rcx, qword [rsi + 0x4e60]
test rcx, rcx
je 0x14009fd66
mov qword [rsi + 0x4e58], 0
mov rax, qword [0x140186d50]
test rax, rax
je 0x14009fd4e
mov edx, dword [rax + 0x3fc0]
movsx r8, word [rax + 0x6228]
cmp dword [rax + r8*8 + 0x622c], edx
jne 0x14009fcf7
movzx edx, word [rax + r8*8 + 0x6232]
inc edx
jmp 0x14009fd3f
inc r8d
movsxd r8, r8d
imul r9, r8, 0x2aaaaaab
mov r10, r9
shr r10, 0x3f
shr r9, 0x20
add r9d, r10d
add r9d, r9d
lea r9d, [r9 + r9*2]
sub r8d, r9d
mov word [rax + 0x6228], r8w
movsxd r8, r8d
mov dword [rax + r8*8 + 0x622c], edx
mov dword [rax + r8*8 + 0x6230], 0
mov dx, 1
mov word [rax + r8*8 + 0x6232], dx
inc dword [rax + 0x6224]
mov rdx, qword [0x140186d60]
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + 0x4e60], 0
movups xmmword [rsi + 0x4e68], xmm6
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400a0a50
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x140186d50]
mov rcx, qword [rax + 0x4078]
mov byte [rcx + 0xcc], 1
mov rax, qword [rax + 0x4078]
mov rcx, qword [rax + 0x110]
movsxd rdx, dword [rax + 0x108]
mov ebp, dword [rcx + rdx*4 - 4]
movzx ecx, byte [r14]
test cl, cl
je 0x1400a0aeb
not ebp
lea rdx, [r14 + 2]
lea r8, [0x140109410]
mov r9d, ebp
jmp 0x1400a0aca
movzx r10d, r10b
movzx r11d, r9b
shr r9d, 8
xor r11d, r10d
xor r9d, dword [r8 + r11*4]
inc rdx
test cl, cl
je 0x1400a0ae5
mov r10d, ecx
movzx ecx, byte [rdx - 1]
cmp r10b, 0x23
jne 0x1400a0ab0
cmp cl, 0x23
jne 0x1400a0ab0
cmp byte [rdx], 0x23
cmove r9d, ebp
jmp 0x1400a0ab0
not r9d
mov ebp, r9d
mov rax, qword [rax]
cmp dword [rax + 0x40cc], ebp
jne 0x1400a0b08
mov ecx, ebp
mov edx, recv
mov r8, r14
xor r9d, r9d
call fcn.1400a3d50
mov dword [rsp + 0x20], ebx
mov rcx, r14
mov edx, ebp
mov r8, rdi
mov r9d, esi
call fcn.1400a0b30
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret