joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027c84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b594
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b594
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027dd4
cmp rax, 0xffffffffffffffff
je 0x140027dd4
xor edi, edi
test rbp, rbp
jle 0x140027d7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dea8
mov rbx, rax
test rax, rax
jne 0x140027d0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027d75
mov edx, 0x8000
mov ecx, r14d
call fcn.140018f00
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c270
cmp eax, 0xffffffff
je 0x140027d55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027d1c
mov edx, r15d
mov ecx, r14d
call fcn.140018f00
jmp 0x140027d75
cmp byte [rsi + 0x38], dil
je 0x140027d6c
cmp dword [rsi + 0x34], 5
jne 0x140027d6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027d75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019c58
jmp 0x140027de8
jns 0x140027de8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b594
cmp rax, 0xffffffffffffffff
jne 0x140027da0
cmp byte [rsi + 0x30], dil
je 0x140027de8
mov edi, dword [rsi + 0x2c]
jmp 0x140027de8
mov ecx, r14d
call fcn.140017a2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027de8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027de8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027de1
mov eax, dword [rsi + 0x2c]
jmp 0x140027de6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b594
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140028ee0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140028f08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140028f08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x142d5de74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142d5de7e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142d5dea7
pop rbp
sub rbp, 0x33
sub rbp, 0x2d5de74
sub rsp, 0x20
jmp 0x142d5dec6
mov rax, 0x2d5de74
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9a6abd97
xor byte [rax], dl
inc rax
dec rcx
jne 0x142d5dee5
jmp 0x142d5defc
fistp word [rsi]
jle 0x142d5df1c
invalid
xchg edi, eax
fbld tbyte [rax + 0x75]
fist word [rsi - 0x64e9e3aa]
xchg edi, eax
xchg edi, eax
xchg edi, eax
fist word [rsi - 0x20383881]
invalid
Function at 0x1400031e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003208
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000322e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003230
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003289
test ecx, ecx
jle 0x140003269
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003289
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003289
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1400032b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400032d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400032e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003304
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003306
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003342
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400033de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000337d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400033be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400033de
cmp rbx, rax
ja 0x140003390
test rbx, rbx
je 0x1400033de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000386d
xor eax, eax
jmp 0x1400039d9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400038a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400038a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400039d9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400039cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400038ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003915
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400039d1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003984
sub eax, 1
je 0x140003984
cmp eax, 2
jne 0x1400039cc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400039d1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400039b2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400039cc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400039d1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400043f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003c20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003cf3
cmp byte [rcx + 0x71], 0
je 0x140003cf3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003cef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003cb4
sub eax, 1
je 0x140003cb8
cmp eax, 2
jne 0x140003cef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400043f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003ce6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003cef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003c9c
xor al, al
jmp 0x140003c9c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400043f0
add rsp, 0x60
pop rbx
ret

Function at 0x140004d70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004dba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004dba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004dba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004dba
cmp dword [rcx + 0x84], 0xe
jbe 0x140004dba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004dbc
xor al, al
add rsp, 0x28
ret
Function at 0x140011316
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x1400141b0
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400400a5]
call fcn.140011dc0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x1a8], 0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140014219
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0x118], 0xa
je 0x140014220
xor eax, eax
jmp 0x14001442b
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x140014429
mov rax, qword [rbp + 0x68]
sub rax, 0x10
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400142ac
jmp 0x140014419
mov rax, qword [rbp + 0xc8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
cmp dword [rax], 0x4550
je 0x1400142df
jmp 0x140014419
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xe8]
cmp dword [rcx + rax + 0x8c], 0
jne 0x1400142fe
jmp 0x140014419
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xe8]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov dword [rbp + 0x1e4], 0
xor eax, eax
mov word [rbp + 0x204], ax
jmp 0x1400143a9
movzx eax, word [rbp + 0x204]
inc ax
mov word [rbp + 0x204], ax
movzx eax, word [rbp + 0x204]
mov rcx, qword [rbp + 0xa8]
cmp eax, dword [rcx + 0x18]
jae 0x140014404
movzx eax, word [rbp + 0x204]
mov rcx, qword [rbp + 0x148]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
movzx eax, word [rax]
cmp eax, 0x744e
je 0x1400143f4
jmp 0x140014398
mov eax, dword [rbp + 0x1e4]
inc eax
mov dword [rbp + 0x1e4], eax
jmp 0x140014398
cmp dword [rbp + 0x1e4], 0xc8
jle 0x140014419
mov rax, qword [rbp + 0x108]
jmp 0x14001442b
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
jmp 0x14001424d
xor eax, eax
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret
Function at 0x14001173a
Capabilities:
Terminate process

Disassembly:
jmp 0x14001cdc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011762
Capabilities:
Check os version

Disassembly:
jmp 0x140012e30
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400400a5]
call fcn.140011dc0
mov qword [rbp + 0xc8], 0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140012e7b
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0x118], 0xa
je 0x140012e7d
jmp 0x140012ef2
mov qword [rbp + 0x68], 0
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012ecc
jmp 0x140012ef2
mov rax, qword [rbp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
cmp qword [rbp + 0xc8], 0
jne 0x140012f20
call fcn.140011316
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
je 0x140012f20
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x140011915
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e150
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e170
xor al, al
jmp 0x14001e1f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001e183
xor al, al
jmp 0x14001e1f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001e1ad
xor al, al
jmp 0x14001e1f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001e1c1
xor al, al
jmp 0x14001e1f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001e1d3
xor al, al
jmp 0x14001e1f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001e1ef
xor al, al
jmp 0x14001e1f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140131d2f
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jmp 0x140131efd
add r14, r9
mov qword [rbp + 0x178], 0x30
mov r9d, 0x64
xchg rcx, r15
Function at 0x14013396f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
outsb dx, byte [rsi]
je 0x140132c01
ret 0x10
Function at 0x1400027d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14015ee94], 0
lea rdi, [0x14015ee90]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x1400028a8
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x140002800
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1400028de
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1400028c0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x14000291f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140002903
cmp byte [r8], r9b
jne 0x140002903
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400028f0
not eax
pop rdi
ret
Function at 0x140012040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x20
mov rbx, qword [0x14015eb90]
xor esi, esi
mov r15, rcx
mov dword [rbx + 0x2d9c], esi
test rcx, rcx
je 0x14001216a
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
lea rdi, [rbx + 0x2da0]
mov dword [rbx + 0x2d9c], esi
mov r8d, dword [rdi + 4]
test r8d, r8d
jns 0x1400120a2
mov eax, r8d
mov rcx, rdi
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, r8d
test eax, eax
cmovg edx, eax
call fcn.140012fd0
mov r8d, dword [rdi + 4]
mov dword [rdi], esi
mov eax, esi
test r8d, r8d
jne 0x1400120b9
lea edx, [r8 + 8]
mov rcx, rdi
call fcn.140012fd0
mov eax, dword [rdi]
movsxd rcx, eax
mov ebp, esi
mov rax, qword [rdi + 8]
mov byte [rcx + rax], sil
inc dword [rdi]
cmp dword [rbx + 0x2db0], esi
jle 0x14001210a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax + rax]
mov r9, qword [rbx + 0x2db8]
mov r8, rdi
add r9, r14
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rbx + 0x2db0]
jl 0x1400120e0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
cmp qword [rdi + 8], rsi
je 0x140012119
mov esi, dword [rdi]
dec esi
mov rax, qword [rbx + 0x2da8]
lea rdi, [0x14015eb88]
test rax, rax
movsxd rsi, esi
lea rdx, [0x140047c74]
mov rcx, r15
cmovne rdi, rax
call fcn.140002930
mov rbx, rax
test rax, rax
je 0x140012165
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbx
ret
Function at 0x140019df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x14001a03e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x14004d660]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140019eac
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140019ecb
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140019fe6
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140019f20
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140019f23
mov edx, dword [rax + rsi]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140014ec0
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1400177b0
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x140019f10
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x140019e60
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret