joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov r14, r9
mov rdi, r8
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
mov r10d, dword [rsp + 0x40]
mov r9d, 0
mov r11, rax
mov eax, 0x811c9dc5
add r10, r10
je 0x1400456a0
movzx ecx, byte [r9 + r11]
inc r9
xor ecx, eax
imul eax, ecx, 0x1000193
cmp r9, r10
jb 0x14004568b
xor edx, edx
mov dword [r14], eax
div dword [rbx + 0x18]
mov rbx, qword [rbx + 8]
mov dword [rdi], edx
test rbx, rbx
je 0x1400456ff
mov rsi, qword [rsp + 0x60]
xor edi, edi
mov rbx, qword [rbx + rdx*8]
and qword [rsi], rdi
test rbx, rbx
je 0x1400456ff
mov eax, dword [r14]
cmp dword [rbx + 0x18], eax
jne 0x1400456e9
mov r8, qword [r15]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx]
call fcn.1400455bc
test eax, eax
js 0x14004570a
cmp byte [rsp + 0x40], 0
jne 0x1400456f2
mov rdi, rbx
mov rbx, qword [rbx + 0x10]
jmp 0x1400456c1
mov rax, qword [rsp + 0x68]
mov qword [rsi], rdi
mov qword [rax], rbx
jmp 0x140045708
mov rax, qword [rsp + 0x68]
and qword [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140059004
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xc8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
nop dword [rax + rax]
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.140058d90
xor edi, edi
test eax, eax
js 0x1400590bf
mov rcx, qword [rbx + 0xf8]
call fcn.14005c764
test eax, eax
js 0x1400590bf
mov qword [rbx + 0xd0], rdi
lea rdx, [rbx + 0xd0]
mov qword [rbx + 0xd8], rdi
mov qword [rbx + 0xe0], rdi
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rbx + 0xb8]
mov qword [rbx + 0xe8], rax
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_ConnectNamedPipe]
nop dword [rax + rax]
test eax, eax
jne 0x14005909c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov dword [rbx + 0xf0], edi
cmp edi, 0x3e5
je 0x1400590bd
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005b4c8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov esi, 1
lock add dword [rcx + 0x58], esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_StartThreadpoolIo]
nop dword [rax + rax]
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x38], sil
mov rax, qword [rbx + 8]
mov rcx, qword [rax]
lea r9, [rcx + 0x10]
mov r8d, dword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x90]
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14005b566
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3e5
je 0x14005b566
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebx, 0x8000ffff
test ecx, ecx
cmovs ebx, ecx
jmp 0x14005b58a
mov rax, qword [rdi]
movabs r10, 0xfd41b67356dad870
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400de008]
xor sil, sil
mov byte [rsp + 0x38], sil
xor ebx, ebx
test sil, sil
je 0x14005b5a3
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CancelThreadpoolIo]
nop dword [rax + rax]
lock dec dword [rdi + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14005b5bc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov esi, 1
lock add dword [rcx + 0x58], esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_StartThreadpoolIo]
nop dword [rax + rax]
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x38], sil
mov rax, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rax + 0xb0], xmm0
movups xmmword [rax + 0xc0], xmm0
mov rcx, qword [rbx]
mov rax, qword [rcx + 0xa8]
mov qword [rcx + 0xc8], rax
mov rcx, qword [rbx]
lea r9, [rcx + 0xb0]
mov rax, qword [rcx + 0xe8]
mov r8, qword [rcx + 0xf0]
sub r8, rax
mov edx, dword [rcx + 0x100]
sub r8d, edx
add rdx, rax
mov rax, qword [rcx + 0x90]
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov rcx, qword [rax + 0x20]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14005b697
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3e5
je 0x14005b697
cmp eax, 0xea
je 0x14005b697
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebx, 0x8000ffff
test ecx, ecx
cmovs ebx, ecx
jmp 0x14005b6bb
mov rax, qword [rdi]
movabs r10, 0xfd41b67356dad870
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [0x1400de008]
xor sil, sil
mov byte [rsp + 0x38], sil
xor ebx, ebx
test sil, sil
je 0x14005b6d4
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CancelThreadpoolIo]
nop dword [rax + rax]
lock dec dword [rdi + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c37d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov ebx, r9d
mov rsi, r8
mov r14d, edx
mov r12, rcx
mov r9d, edx
sub r9d, 0xe
je 0x1400c3931
sub r9d, 1
je 0x1400c3885
sub r9d, 1
je 0x1400c385d
cmp r9d, 1
je 0x1400c3835
test ebx, ebx
je 0x1400c39d8
mov edx, r14d
mov rcx, rsi
call fcn.1400998dc
add ebx, 0xffffffff
jne 0x1400c3820
jmp 0x1400c39d8
mov qword [rbp - 0x18], rsi
xor edi, edi
mov byte [rbp - 0x10], dil
test ebx, ebx
je 0x1400c3858
mov byte [rbp - 0x10], dil
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.14009fe04
add ebx, 0xffffffff
jne 0x1400c3843
jmp 0x1400c39d8
mov qword [rbp - 0x18], rsi
xor edi, edi
mov byte [rbp - 0x10], dil
test ebx, ebx
je 0x1400c3880
mov byte [rbp - 0x10], dil
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.14009fe04
add ebx, 0xffffffff
jne 0x1400c386b
jmp 0x1400c39d8
mov qword [rbp - 0x18], rsi
xor edi, edi
mov byte [rbp - 0x10], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov r15, qword [rcx + 8]
mov r14, qword [rcx]
mov rax, r15
sub rax, r14
sar rax, 1
cmp rbx, rax
jae 0x1400c38cb
lea rax, [r14 + rbx*2]
cmp rax, r14
jne 0x1400c38bd
mov qword [rcx + 8], r14
mov r15, r14
jmp 0x1400c38ee
cmp rax, r15
je 0x1400c38ee
mov r15, rax
mov qword [rcx + 8], rax
jmp 0x1400c38ee
jbe 0x1400c38ee
sub r9, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, r15
lea rdx, [rbp - 0x20]
call fcn.1400c6e9c
mov r15, qword [r12 + 8]
mov r14, qword [r12]
cmp r14, r15
je 0x1400c392c
mov r12d, 1
mov rbx, r14
add r14, 2
mov byte [rbp - 0x10], dil
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1400a73c0
movzx eax, word [rbp + 0x38]
movzx ecx, ax
shr cx, 1
and ax, r12w
neg ax
xor cx, ax
mov word [rbx], cx
cmp r14, r15
jne 0x1400c38f9
jmp 0x1400c39d8
mov qword [rbp - 0x18], rsi
xor edi, edi
mov byte [rbp - 0x10], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov r10, qword [rcx + 8]
mov r8, qword [rcx]
mov rax, r10
sub rax, r8
sar rax, 1
cmp rbx, rax
jae 0x1400c3977
lea rax, [r8 + rbx*2]
cmp rax, r8
jne 0x1400c3969
mov qword [rcx + 8], r8
mov r10, r8
jmp 0x1400c399a
cmp rax, r10
je 0x1400c399a
mov r10, rax
mov qword [rcx + 8], rax
jmp 0x1400c399a
jbe 0x1400c399a
sub r9, rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, r10
lea rdx, [rbp - 0x20]
call fcn.1400c6e9c
mov r10, qword [r12 + 8]
mov r8, qword [r12]
cmp r8, r10
je 0x1400c39d8
mov r12d, 1
mov r11, r8
add r8, 2
mov byte [rbp - 0x10], dil
mov r9d, dword [rsi + 0x20]
mov eax, dword [rsi + 0x18]
sub eax, r9d
cmp eax, r12d
jb 0x1400c39f2
mov rax, qword [rsi + 0x10]
movsx edx, byte [r9 + rax]
lea eax, [r9 + 1]
mov dword [rsi + 0x20], eax
mov word [r11], dx
cmp r8, r10
jne 0x1400c39a5
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov edx, r12d
mov rcx, rsi
call fcn.140077a94
int3
Function at 0x1400d2330
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140125868], rbx
je 0x1400d237c
cmp rax, rbx
jne 0x1400d236f
mov ebx, 1
mov esi, ebx
jmp 0x1400d2381
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400d2354
mov ebx, 1
mov eax, dword [0x140125870]
cmp eax, ebx
jne 0x1400d2397
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400d2406
mov eax, dword [0x140125870]
test eax, eax
jne 0x1400d2400
mov dword [0x140125870], ebx
lea r15, [0x1400dea18]
lea rdi, [0x1400dea00]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400d23f2
test eax, eax
jne 0x1400d23f6
cmp qword [rdi], 0
je 0x1400d23e7
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x1400de008]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400d23be
test eax, eax
je 0x1400d2406
mov eax, 0xff
jmp 0x1400d24ec
mov dword [0x1401157a0], ebx
mov eax, dword [0x140125870]
cmp eax, ebx
jne 0x1400d242d
lea rdx, [0x1400de9f8]
lea rcx, [0x1400de018]
call sub.msvcrt.dll__initterm
mov dword [0x140125870], 2
test esi, esi
jne 0x1400d243a
xor eax, eax
xchg qword [0x140125868], rax
cmp qword [0x140125888], 0
je 0x1400d2478
lea rcx, [0x140125888]
call fcn.1400d29a0
test eax, eax
je 0x1400d2478
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140125888]
mov r9, qword [0x1400de008]
call r9
mov r8, qword [0x1401157b8]
mov rdx, qword [0x1401157b0]
mov ecx, dword [0x1401157a8]
call fcn.14000c23c
mov dword [0x14011579c], eax
cmp dword [0x1401157c0], 0
jne 0x1400d24a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1401157a0], 0
jne 0x1400d24bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14011579c]
jmp 0x1400d24ec
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401bf000
add rsp, 0x28
jmp 0x1400d2330

Function at 0x1400d288c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400d28d8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400d28d0
cmp dword [rcx + 0x3c], edx
jl 0x1400d28d0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400d28d0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400d28d8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000ded0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
mov rax, qword [0x140052170]
mov r12, rcx
mov rbx, rdx
test rax, rax
je 0x14000df68
test rcx, rcx
je 0x14000df48
call sym.strlen
lea r13, [rsp + 0x20]
mov rdx, r12
mov rcx, r13
mov r8, rax
call sym.toNimStr
mov r12, qword [rsp + 0x28]
mov rcx, r13
call qword [0x140052170]
test r12, r12
je 0x14000df23
test byte [r12 + 7], 0x40
je 0x14000dfa0
lea rcx, [0x140044400]
call sym.__emutls_get_address
cmp byte [rax], 0
jne 0x14000dfc0
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], 0
call rax
jmp 0x14000df23
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov rcx, r12
mov r8, rbx
mov edx, 1
mov r13, rax
mov r9, rax
call sym.fwrite
mov rcx, r13
add rsp, 0x30
pop rbx
pop r12
pop r13
jmp sym.fflush
lea rcx, [0x140044420]
call sym.__emutls_get_address
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u6906
jmp 0x14000df23
mov byte [rax], 0
lea rcx, [0x140044340]
call sym.__emutls_get_address
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x30
pop rbx
pop r12
pop r13
jmp sym.eqcopy___stdZtypedthreads_u169

Function at 0x1400100b0
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r13, [0x140052140]
mov rsi, rdx
mov rbx, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
jle 0x14001013f
lea rcx, [0x140044400]
xor r14d, r14d
lea r12, [rsp + 0x20]
call sym.__emutls_get_address
mov rbp, qword [sym.__acrt_iob_func]
mov rdi, rax
jmp 0x14001010d
add r14, 1
add rbx, 0x10
cmp rsi, r14
je 0x140010146
mov ecx, 1
call rbp
movdqu xmm0, xmmword [rbx]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
movaps xmmword [rsp + 0x20], xmm0
call sym.writeWindows__system_u8891
cmp byte [rdi], 0
je 0x140010100
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbp, qword [sym.__acrt_iob_func]
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x140045521]
mov r9, rax
call sym.fwrite
mov ecx, 1
call rbp
mov rcx, rax
call sym.fflush
mov rcx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400263d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov rcx, r8
test rax, rax
je 0x1400263f8
mov r8, qword [rax]
cmp word [r8 + 0x12], 1
jle 0x140026430
mov r8, qword [r8 + 0x18]
cmp dword [r8 + 8], 0x68676800
jne 0x140026430
test rcx, rcx
js 0x140026410
mov r9, qword [rax + 0x58]
mov r8, rcx
mov rcx, r9
add rsp, 0x28
jmp sym.readBuffer__stdZsyncio_u165
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
xor eax, eax
add rsp, 0x28
ret
call sym.raiseObjectConversionError
xor eax, eax
add rsp, 0x28
ret

Function at 0x140026440
Capabilities:
Read file on windows

Disassembly:
push r12
sub rsp, 0x20
mov r9, qword [r8]
mov rax, rcx
mov rcx, qword [r8 + 8]
test rax, rax
je 0x14002646e
mov r8, qword [rax]
cmp word [r8 + 0x12], 1
jle 0x1400264d0
mov r8, qword [r8 + 0x18]
cmp dword [r8 + 8], 0x68676800
jne 0x1400264d0
mov r8, qword [rdx]
test r9, r9
js 0x1400264b0
cmp r8, r9
jle 0x1400264b0
add rcx, 1
jo 0x1400264e8
xor r12d, r12d
sub rcx, r9
seto r12b
jo 0x1400264e8
test rcx, rcx
js 0x140026500
mov rdx, qword [rdx + 8]
mov r8, rcx
lea rdx, [rdx + r9 + 8]
mov r9, qword [rax + 0x58]
mov rcx, r9
add rsp, 0x20
pop r12
jmp sym.readBuffer__stdZsyncio_u165
lea rdx, [r8 - 1]
mov rcx, r9
xor r12d, r12d
call sym.raiseIndexError2
mov rax, r12
add rsp, 0x20
pop r12
ret
call sym.raiseObjectConversionError
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop r12
ret
call sym.raiseOverflow
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x1400264bf
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140013020
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014370
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014390
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400143a3
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400143cd
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400143e1
xor al, al
jmp 0x140014411
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400143f3
xor al, al
jmp 0x140014411
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001440f
xor al, al
jmp 0x140014411
mov al, 1
add rsp, 0x38
ret
Function at 0x140012260
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001139d
movzx eax, al
test eax, eax
jne 0x140012280
mov ecx, 7
call fcn.14001131b
nop
mov byte [rsp + 0x20], 0
call fcn.14001132f
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x1400122a4
mov ecx, 7
call fcn.14001131b
nop
jmp 0x1400122fc
cmp dword [0x14001d868], 0
jne 0x1400122f7
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.14001119f
test eax, eax
je 0x1400122d8
mov eax, 0xff
jmp 0x140012401
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011325
mov dword [0x14001d868], 2
jmp 0x1400122fc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011307
call fcn.1400112a3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012359
mov rcx, qword [rsp + 0x30]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140012359
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112d5
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001238d
mov rcx, qword [rsp + 0x38]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x14001238d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001135c
nop
call fcn.1400124b0
mov dword [rsp + 0x28], eax
call fcn.140011280
movzx eax, al
test eax, eax
jne 0x1400123ac
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400123bb
call fcn.140011366
nop
xor edx, edx
mov cl, 1
call fcn.140011145
mov eax, dword [rsp + 0x28]
jmp 0x140012401
add rsp, 0x68
ret
Function at 0x14000f640
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000f69d
lea rbx, [0x140088d30]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000f684
cmp r10, 2
jb 0x14000f684
cmp byte [r9], r8b
jne 0x14000f684
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000f660
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000f6df
lea rbx, [0x140088d30]
cmp r8b, 0x23
jne 0x14000f6c3
cmp byte [r9], r8b
jne 0x14000f6c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000f6b0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000f820
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000f83a
mov qword [r8], 0
lea rdx, [0x14008e4dc]
call fcn.14000f6f0
mov rbx, rax
test rax, rax
jne 0x14000f85a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000f933
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f933
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000f933
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f933
cmp rdi, 0xffffffffffffffff
je 0x14000f933
mov rax, qword [0x1404af710]
test rax, rax
je 0x14000f8d0
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000f933
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000f920
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1404af710]
test rax, rax
je 0x14000f915
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000f93c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000f92e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000f93e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400144b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
lea r8, [0x140088d30]
movsxd rcx, dword [rcx + 0xe8]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x1404af710]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140014545
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140028d50
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140014550
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x108]
lea r10, [0x140088d30]
mov rax, qword [rcx + 0xf0]
movss xmm1, dword [rcx + 0x10c]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xe8]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret