joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014c80
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push r14
sub rsp, 0x28
movzx eax, word [rcx]
movzx r14d, r8b
mov rsi, rcx
test ax, ax
jne 0x140014c9f
add rsp, 0x28
pop r14
pop rsi
ret
cmp word [rcx + 2], 0
jne 0x140014cba
mov r8, qword [rsp + 0x60]
movzx ecx, ax
add rsp, 0x28
pop r14
pop rsi
jmp fcn.140014db0
mov qword [rsp + 0x40], rbx
test r9b, r9b
je 0x140014d12
movzx ebx, ax
test ebx, 0xffffff80
jne 0x140014ce2
mov edx, 2
mov ecx, ebx
call fcn.1400cb124
test eax, eax
je 0x140014ce2
and ebx, 0xffffffdf
cmp bx, 0x56
jne 0x140014d12
movzx ecx, word [rsi + 2]
call fcn.14000b150
cmp ax, 0x4b
jne 0x140014d12
xor edx, edx
lea rcx, [rsi + 4]
lea r8d, [rdx + 0x10]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r14
pop rsi
jmp fcn.1400cc5c8
mov qword [rsp + 0x48], rbp
xor ebp, ebp
mov qword [rsp + 0x50], rdi
mov edi, ebp
mov qword [rsp + 0x58], r12
lea r12, str.Numpad0
mov qword [rsp + 0x20], r15
mov rbx, r12
lea r15, [0x140130210]
nop dword [rax + rax]
mov rcx, qword [rbx]
mov rdx, rsi
call fcn.1400c8580
test eax, eax
je 0x140014d81
inc edi
add rbx, 0x10
cmp rbx, r15
jl 0x140014d40
test r14b, r14b
je 0x140014d63
xor al, al
jmp 0x140014d8e
mov rcx, rsi
call fcn.140014b90
test ax, ax
je 0x140014d7b
movzx ecx, ax
call fcn.140015470
movzx ebp, al
movzx eax, bpl
jmp 0x140014d8e
movsxd rax, edi
shl rax, 4
movzx eax, byte [rax + r12 + 8]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r14
pop rsi
ret

Function at 0x140014db0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp cx, 0xa
jne 0x140014dc7
mov al, 0xd
add rsp, 0x20
pop rbx
ret
mov rdx, r8
call qword [sym.imp.USER32.dll_VkKeyScanExW]
movsx rdx, ax
mov rcx, rdx
shr rcx, 8
cmp cl, 0xff
jne 0x140014ded
cmp dl, 0xff
jne 0x140014ded
xor al, al
add rsp, 0x20
pop rbx
ret
test cl, 0x38
jne 0x140014de5
test rbx, rbx
je 0x140014e35
movzx eax, cl
and al, 6
cmp al, 6
jne 0x140014e05
or byte [rbx], 8
jmp 0x140014e25
test cl, 2
je 0x140014e15
movzx eax, byte [rbx]
test al, 3
jne 0x140014e15
or al, 1
mov byte [rbx], al
test cl, 4
je 0x140014e25
movzx eax, byte [rbx]
test al, 0xc
jne 0x140014e25
or al, 4
mov byte [rbx], al
test cl, 1
je 0x140014e35
movzx eax, byte [rbx]
test al, 0x30
jne 0x140014e35
or al, 0x10
mov byte [rbx], al
movzx eax, dl
add rsp, 0x20
pop rbx
ret
Function at 0x140015190
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, cl
lea rsi, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
movzx ebx, dl
lea eax, [rdi - 0x5b]
cmp eax, 0x4a
ja case.0x1400151cc.115
cdqe
movzx eax, byte [rsi + rax + 0x15380]
mov ecx, dword [rsi + rax*4 + 0x1531c]
add rcx, rsi
jmp rcx
mov eax, 0x2a
jmp 0x140015283
mov eax, 0x136
jmp 0x140015283
mov eax, 0x1d
jmp 0x140015283
mov eax, 0x11d
jmp 0x140015283
mov eax, gethostname
jmp 0x140015283
mov eax, 0x138
jmp 0x140015283
mov eax, 0x15b
jmp 0x140015283
mov eax, 0x15c
jmp 0x140015283
mov eax, 0x52
jmp 0x140015283
mov eax, 0x4f
jmp 0x140015283
mov eax, 0x50
jmp 0x140015283
mov eax, 0x51
jmp 0x140015283
mov eax, 0x4b
jmp 0x140015283
mov eax, 0x4c
jmp 0x140015283
mov eax, 0x4d
jmp 0x140015283
mov eax, 0x47
jmp 0x140015283
mov eax, 0x48
jmp 0x140015283
mov eax, 0x49
jmp 0x140015283
mov eax, 0x53
jmp 0x140015283
mov eax, 0x145
jmp 0x140015283
mov eax, 0x135
jmp 0x140015283
mov eax, gethostname
jmp 0x140015283
mov eax, 0x4a
jmp 0x140015283
mov eax, 0x4e
test bl, bl
jne 0x1400152d9
movzx eax, ax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, eax
test ax, ax
je 0x1400152d9
add edi, 0xfffffffd
cmp edi, 0x8d
ja case.0x1400152cb.5
movsxd rax, edi
movzx eax, byte [rsi + rax + 0x153d8]
mov ecx, dword [rsi + rax*4 + 0x153cc]
add rcx, rsi
jmp rcx
mov ecx, 0x100
or dx, cx
test bl, bl
je 0x140015309
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, dx
test bl, bl
je 0x14001530c
mov ecx, 0x100
or eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, dx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140015470
Capabilities:
Log keystrokes

Disassembly:
movzx r8d, cx
mov eax, r8d
cmp r8d, 0x11c
ja 0x1400154e6
cmp eax, 0x11c
je 0x1400154e3
sub eax, 0x1d
cmp eax, 0x36
ja case.0x14001550b.286
lea rdx, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
cdqe
movzx eax, byte [rdx + rax + 0x15578]
mov ecx, dword [rdx + rax*4 + 0x15530]
add rcx, rdx
jmp rcx
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
ret
mov al, 0x21
ret
mov al, SafeArrayAllocDescriptor
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x14001550b.286
lea rdx, sym.MZ_kiv9nMDWjqg_I7rrTcpI88_u4Z_bB_FPuaQ9q_
cdqe
movzx eax, byte [rdx + rax + 0x155cc]
mov ecx, dword [rdx + rax*4 + 0x155b0]
add rcx, rdx
jmp rcx
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x90
ret
mov al, 0x6f
ret
mov al, 0x5d
ret
movzx ecx, r8b
mov edx, 1
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
Function at 0x140017130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, r8d
mov r9, rdx
lea rbx, [0x1400faf40]
not ecx
cmp r8d, 8
jb 0x140017228
mov r11d, r10d
shr r11, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x140017160
test r10d, r10d
je 0x140017250
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x140017230
mov rbx, qword [rsp + 8]
not ecx
mov eax, ecx
ret

Function at 0x140017630
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
test byte [rcx], 1
mov edi, r8d
mov r10, rdx
mov rbx, rcx
jne 0x140017696
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140017680
mov eax, esi
mov dword [rbx + 0x10], 7
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov esi, dword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rcx + 0x1c]
mov edx, dword [rbx + 0x18]
lea eax, [rcx + r8]
cmp eax, edx
jbe 0x1400176a8
mov edi, edx
sub edi, ecx
mov rdx, rcx
mov r8d, edi
add rdx, qword [rbx + 8]
mov rcx, r10
call fcn.1400c64d0
add dword [rbx + 0x1c], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400176d0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rbx, rcx
jne 0x14001777a
test byte [rcx], 1
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov edi, 2
jne 0x140017728
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x48]
xor esi, esi
lea rdx, [rsp + 0x40]
mov r8d, edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140017722
mov dword [rbx + 0x10], 7
jmp 0x140017755
mov esi, dword [rsp + 0x48]
jmp 0x140017755
mov esi, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x18]
lea eax, [rsi + 2]
cmp eax, ecx
jbe 0x140017739
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400c64d0
lea eax, [rsi + rdi]
mov esi, edi
mov dword [rbx + 0x1c], eax
mov rdi, qword [rsp + 0x58]
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x14001777a
movzx eax, byte [rsp + 0x41]
movzx ecx, byte [rsp + 0x40]
shl ax, 8
or ax, cx
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x140017790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x40], edi
cmp dword [rcx + 0x10], edi
jne 0x14001785b
test byte [rcx], 1
mov qword [rsp + 0x50], rsi
lea esi, [rdi + 4]
jne 0x1400177e8
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400177e2
mov dword [rbx + 0x10], 7
jmp 0x140017815
mov edi, dword [rsp + 0x48]
jmp 0x140017815
mov edi, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x18]
lea eax, [rdi + 4]
cmp eax, ecx
jbe 0x1400177f9
mov esi, ecx
sub esi, edi
mov rdx, rdi
mov r8d, esi
add rdx, qword [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400c64d0
lea eax, [rdi + rsi]
mov edi, esi
mov dword [rbx + 0x1c], eax
mov rsi, qword [rsp + 0x50]
test edi, edi
je 0x14001784c
movzx ecx, byte [rsp + 0x42]
movzx eax, byte [rsp + 0x43]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x41]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x40]
shl eax, 8
or eax, ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov eax, edi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140018860
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp byte [rcx], 0
mov edi, edx
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 1
je 0x14001889c
cmp byte [rcx + 1], 0x3a
jne 0x14001889c
add rcx, 2
cmp byte [rcx], 0x5c
lea rbx, [rcx + 1]
cmovne rbx, rcx
cmp byte [rbx], 0
je 0x1400188fb
nop dword [rax]
movzx eax, byte [rbx]
test al, al
je 0x1400188c6
cmp al, 0x5c
je 0x140018910
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x1400188b7
xor ebx, ebx
test edi, edi
je 0x1400188fb
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400188eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140018915
test rbx, rbx
je 0x1400188fb
mov byte [rbx], 0x5c
inc rbx
cmp byte [rbx], 0
jne 0x1400188b0
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov byte [rbx], 0
jmp 0x1400188cc
test rbx, rbx
je 0x14001891d
mov byte [rbx], 0x5c
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140018930
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
mov edi, edx
mov qword [rsp + 0x28], rbp
mov rsi, rcx
mov dword [rsp + 0x30], 1
cmp word [rcx], bp
je 0x140018970
cmp word [rcx + 2], 0x3a
jne 0x140018970
add rcx, 4
cmp word [rcx], 0x5c
lea rbx, [rcx + 2]
mov qword [rsp + 0x50], r14
cmovne rbx, rcx
cmp word [rbx], bp
je 0x1400189e3
mov r14d, 0x5c
nop dword [rax]
movzx eax, word [rbx]
test ax, ax
je 0x1400189ab
cmp ax, r14w
je 0x140018a02
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140018998
mov rbx, rbp
test edi, edi
je 0x1400189e3
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400189d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140018a07
test rbx, rbx
je 0x1400189e3
mov word [rbx], r14w
add rbx, 2
cmp word [rbx], bp
jne 0x140018990
mov eax, 1
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov word [rbx], bp
jmp 0x1400189b2
test rbx, rbx
je 0x140018a10
mov word [rbx], r14w
xor eax, eax
jmp 0x1400189e8
Function at 0x140018a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rdx
mov edi, 1
mov edx, edi
mov r14d, r9d
mov rbp, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140018c56
cmp dword [rbx + 0x2c], 0xffffffff
je 0x140018c56
mov qword [rsp + 0x70], r15
xor r15d, r15d
mov dword [rbx + 0x10], r15d
test dil, r14b
je 0x140018ae4
cmp word [rbx + 0x68], r15w
jne 0x140018a8e
mov rdx, rbp
mov rcx, rbx
call fcn.140017e00
cmp dword [rbx + 0x10], r15d
jne 0x140018c46
mov word [rbx + 0x68], di
mov r8d, dword [rbp + 0x28]
mov rdx, rsi
mov rcx, rbx
call fcn.1400180d0
mov eax, eax
mov qword [rbp + 0x28], rax
cmp dword [rbx + 0x10], r15d
jne 0x140018ad2
cmp dword [rbx + 0xb8], r15d
je 0x140018ad2
mov eax, 5
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov rcx, rbx
mov word [rbx + 0x68], r15w
call fcn.140017d90
mov eax, dword [rbx + 0x10]
jmp 0x140018ab7
test byte [rbp + 8], 0x10
je 0x140018b12
test r14b, 2
je 0x140018b0e
mov edx, edi
mov rcx, rsi
test r14d, r14d
jns 0x140018b01
call fcn.140018930
jmp 0x140018b06
call fcn.140018860
test eax, eax
je 0x140018c43
xor eax, eax
jmp 0x140018ab7
cmp r14d, 4
je 0x140018b6e
xor edx, edx
mov rcx, rsi
test r14d, r14d
jns 0x140018b29
call fcn.140018930
jmp 0x140018b2e
call fcn.140018860
test eax, eax
je 0x140018c43
mov eax, dword [rbp + 8]
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
test r14d, r14d
jns 0x140018b65
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x140018b6b
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x140018c43
mov rdx, rbp
mov rcx, rbx
call fcn.140017e00
cmp dword [rbx + 0x10], r15d
jne 0x140018c24
cmp qword [rbx + 0x40], r15
jne 0x140018bb0
mov edx, 0x4000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x140018bb0
mov dword [rbx + 0x10], 2
cmp dword [rbx + 0x10], r15d
jne 0x140018c24
nop word [rax + rax]
mov rdx, qword [rbx + 0x40]
mov r8d, 0x4000
mov rcx, rbx
call fcn.1400180d0
mov edi, eax
test eax, eax
je 0x140018c09
mov rdx, qword [rbx + 0x40]
lea r9, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018bfc
cmp dword [rsp + 0x40], edi
je 0x140018c03
mov dword [rbx + 0x10], 3
cmp dword [rbx + 0x10], r15d
je 0x140018bc0
cmp dword [rbx + 0x10], r15d
jne 0x140018c24
lea r9, [rbp + 0x1c]
mov rcx, rsi
lea r8, [rbp + 0xc]
lea rdx, [rbp + 0x14]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp r14d, 4
je 0x140018c46
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140017d90
mov eax, dword [rbx + 0x10]
jmp 0x140018ab7
mov dword [rbx + 0x10], edi
mov rcx, rbx
call fcn.140017d90
mov eax, dword [rbx + 0x10]
jmp 0x140018ab7
mov eax, 9
jmp 0x140018abc
Function at 0x14001ad30
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
call fcn.14001ac50
mov r8d, dword [rbx + 0x1af80]
lea eax, [r8 + 3]
cmp eax, dword [rbx + 0x1af84]
jb 0x14001ad79
mov rdx, qword [rbx + 0x1af78]
mov rcx, qword [rbx]
call fcn.14001bcf0
mov dword [rbx + 0x1af80], 0
mov ecx, dword [rbx + 0x1af80]
mov rax, qword [rbx + 0x1af78]
mov byte [rcx + rax], dil
movzx ecx, di
inc dword [rbx + 0x1af80]
mov edx, dword [rbx + 0x1af80]
mov rax, qword [rbx + 0x1af78]
shr cx, 8
mov byte [rdx + rax], cl
movzx ecx, dil
inc dword [rbx + 0x1af80]
not cl
mov edx, dword [rbx + 0x1af80]
mov rax, qword [rbx + 0x1af78]
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af80]
mov ecx, dword [rbx + 0x1af80]
mov rax, qword [rbx + 0x1af78]
mov byte [rcx + rax], 0
inc dword [rbx + 0x1af80]
mov r8d, dword [rbx + 0x1af80]
mov rdx, qword [rbx + 0x1af78]
mov rcx, qword [rbx]
call fcn.14001bcf0
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov dword [rbx + 0x1af80], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001bcf0

Function at 0x14001b610
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
mov edx, 0x8074b50
call fcn.14001bb50
mov edx, 0x807
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 8]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0xa]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0xe]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 0x10]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0x12]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001bb50

Function at 0x14001b690
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov edx, dword [rcx + 4]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 6]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 8]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0xa]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0xe]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 0x10]
mov rcx, rdi
call fcn.14001bb50
movzx edx, word [rbx + 0x12]
mov rcx, rdi
call fcn.14001bb50
mov edx, dword [rbx + 0x14]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001bb50
Function at 0x14001b720
Capabilities:
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
jge 0x14001b790
mov edx, 0x8b1f
call fcn.14001bb50
mov edx, 0x808
mov rcx, rbx
call fcn.14001bb50
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14001bb50
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14001bb50
mov edx, 0xb02
mov rcx, rbx
call fcn.14001bb50
mov r8d, dword [rdi + 0x14]
lea rdx, [rdi + 0x40]
inc r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001bcf0
mov edx, 0x4034b50
call fcn.14001bb50
mov edx, 0x403
mov rcx, rbx
call fcn.14001bb50
mov edx, 0x2d
mov rcx, rbx
call fcn.14001bb50
movzx edx, word [rdi + 0x24]
mov rcx, rbx
call fcn.14001bb50
movzx edx, word [rdi + 2]
mov rcx, rbx
call fcn.14001bb50
mov rdx, rbx
mov rcx, rdi
call fcn.14001b690
mov edx, dword [rdi + 0x18]
mov rcx, rbx
call fcn.14001bb50
mov r8d, dword [rdi + 0x14]
lea rdx, [rdi + 0x40]
mov rcx, rbx
call fcn.14001bcf0
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14001b807
mov rdx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.14001bcf0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ba10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x14001ba26
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x1400faf40]
not ecx
cmp r10d, 8
jb 0x14001bb18
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x14001ba50
test r10d, r10d
je 0x14001bb40
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x14001bb20
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x14001bb50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x20], 0
mov rbx, rcx
movsxd r11, edx
jne 0x14001bcdb
mov r10d, r11d
mov byte [rsp + 0x40], r11b
shr r10d, 8
test byte [rcx], 0x10
mov byte [rsp + 0x41], r10b
je 0x14001bc64
mov r8d, dword [rcx + 0x40]
mov edx, dword [rcx + 0x38]
mov r9d, r8d
mov ecx, edx
movsx rax, r11b
xor rcx, rax
shr edx, 8
movzx eax, cl
and r9d, 0xfffd
or r9d, 2
mov qword [rsp + 0x48], rdi
lea rdi, [0x1400faf40]
mov ecx, dword [rdi + rax*4]
xor ecx, edx
mov dword [rbx + 0x38], ecx
movzx eax, cl
add eax, dword [rbx + 0x3c]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x3c], ecx
movzx eax, byte [rbx + 0x3f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rdi + rcx*4]
xor eax, r8d
mov dword [rbx + 0x40], eax
mov eax, r9d
mov r8d, dword [rbx + 0x40]
xor eax, 1
mov edx, dword [rbx + 0x38]
mov ecx, edx
imul eax, r9d
mov r9d, r8d
shr edx, 8
and r9d, 0xfffd
or r9d, 2
shr eax, 8
xor al, r11b
mov byte [rsp + 0x40], al
movsx rax, r10b
xor rcx, rax
movzx eax, cl
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [rbx + 0x3c]
mov dword [rbx + 0x38], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x3c], ecx
movzx eax, byte [rbx + 0x3f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x48]
xor eax, r8d
mov dword [rbx + 0x40], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor r10b, al
mov byte [rsp + 0x41], r10b
test byte [rbx], 1
je 0x14001bc97
mov ecx, dword [rbx + 0x30]
lea eax, [rcx + 2]
cmp eax, dword [rbx + 0x34]
jb 0x14001bc81
mov dword [rbx + 0x20], reloc.WSOCK32.dll_inet_ntoa
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x40]
mov rdx, rcx
mov rcx, qword [rbx + 8]
mov word [rdx + rcx], ax
add dword [rbx + 0x30], 2
jmp 0x14001bccc
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001bcc5
cmp dword [rsp + 0x50], 2
je 0x14001bccc
mov dword [rbx + 0x20], 3
test dword [rbx], 0x40000000
je 0x14001bcdb
mov dword [rbx + 0x20], reloc.OLEAUT32.dll_SafeArrayLock
add rsp, 0x30
pop rbx
ret