joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d6180
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7260
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6b82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d6c1a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d6bfe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6bf2
cmp qword [rbp - 0x10], 0
je 0x2fc4d6bf2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6bb8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d6c1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6d20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6d48
mov eax, 0
jmp 0x2fc4d6d96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6d71
mov eax, 0
jmp 0x2fc4d6d96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6d91
mov eax, 0
jmp 0x2fc4d6d96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6d9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d6e1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6e11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6e11
mov rax, qword [rbp - 8]
jmp 0x2fc4d6e2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6de4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d8480
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9560
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d8e82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d8f1a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d8efe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8ef2
cmp qword [rbp - 0x10], 0
je 0x2fc4d8ef2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8eb8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d8f1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9020
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9048
mov eax, 0
jmp 0x2fc4d9096
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9071
mov eax, 0
jmp 0x2fc4d9096
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9091
mov eax, 0
jmp 0x2fc4d9096
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d909c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d911a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9111
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9111
mov rax, qword [rbp - 8]
jmp 0x2fc4d912f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d90e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x414260
Capabilities:
Terminate process

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, 1
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r12
add rsp, 0x20
pop r12
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]

Function at 0x588b70
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov rbx, qword [rsp + 0x40]
mov r11d, ecx
mov dword [rsp + 0x20], ecx
lea ecx, [rdx*8]
mov rdi, r9
mov eax, r11d
and ecx, 0x1f
add r9, r8
ror eax, cl
lea rsi, [r9 - 7]
mov r11, rax
shl r11, 0x20
or r11, rax
cmp r8, rsi
jae 0x588bdd
mov rcx, rbx
mov rax, r8
nop dword [rax]
mov r10, qword [rax]
add rax, 8
add rcx, 8
xor r10, r11
mov qword [rcx - 8], r10
cmp rax, rsi
jb 0x588bb0
sub rdi, 8
shr rdi, 3
lea rax, [rdi*8 + 8]
add r8, rax
add rbx, rax
cmp r9, r8
je 0x588c0e
sub r9, r8
xor eax, eax
nop word [rax + rax]
movsxd rcx, edx
add edx, 1
movzx ecx, byte [rsp + rcx + 0x20]
xor cl, byte [r8 + rax]
and edx, 3
mov byte [rbx + rax], cl
add rax, 1
cmp rax, r9
jne 0x588bf0
pop rbx
pop rsi
pop rdi
ret

Function at 0x6c1370
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov edx, 2
jmp fcn.006df250

Function at 0x6c1380
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov edx, 3
jmp fcn.006df250

Function at 0x6c1390
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov edx, 4
jmp fcn.006df250
Function at 0x6dea80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rdx
mov rsi, rcx
mov ebp, r8d
call fcn.006dea00
test r12, r12
je 0x6dec89
test eax, eax
jne 0x6dec89
mov rbx, qword [rsi + 0x28]
mov edi, dword [rbx + 0x2c]
cmp edi, 2
je 0x6dec89
cmp edi, 1
je 0x6deb2d
mov eax, dword [rbx + 0x9c]
test eax, eax
jne 0x6dec89
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x2c], 0
cmp eax, ebp
ja 0x6deb69
test edi, edi
jne 0x6deb26
mov eax, dword [rbx + 0x74]
mov rcx, qword [rbx + 0x68]
xor r9d, r9d
xor edx, edx
lea r8d, [rax - 1]
mov word [rcx + r8*2], r9w
add r8, r8
call sub.msvcrt.dll_memset
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x94], 0
mov dword [rbx + 0x84], 0
mov dword [rbx + 0x1708], 0
sub ebp, eax
add r12, rbp
jmp 0x6deb6b
cmp dword [rbx + 8], 0x2a
jne 0x6dec89
mov edx, dword [rbx + 0x9c]
mov eax, 0xfffffffe
test edx, edx
jne 0x6dec78
mov ecx, dword [rsi + 0x4c]
mov r8d, ebp
mov rdx, r12
call fcn.006dd1c0
mov dword [rsi + 0x4c], eax
mov eax, dword [rbx + 0x44]
mov dword [rbx + 0x2c], 0
cmp ebp, eax
jae 0x6deb26
mov eax, ebp
mov ecx, dword [rsi + 8]
mov rbp, qword [rsi]
mov dword [rsi + 8], eax
mov qword [rsi], r12
mov dword [rsp + 0x2c], ecx
nop dword [rax + rax]
mov rcx, rbx
call fcn.006dd690
mov r8d, dword [rbx + 0x9c]
cmp r8d, 2
jbe 0x6dec28
mov r15, qword [rbx + 0x50]
mov r14d, dword [rbx + 0x7c]
mov qword [rsp + 0x80], rsi
mov eax, dword [rbx + 0x94]
mov ecx, dword [rbx + 0x80]
mov r13, qword [rbx + 0x68]
mov r12, qword [rbx + 0x60]
mov r11d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x70]
lea r10d, [r8 + rax - 2]
nop dword [rax]
lea r8d, [rax + 2]
shl edx, cl
mov r9d, r11d
movzx r8d, byte [r15 + r8]
and r9d, eax
xor edx, r8d
and edx, r14d
mov r8d, edx
mov dword [rbx + 0x70], edx
lea r8, [r13 + r8*2]
movzx esi, word [r8]
mov word [r12 + r9*2], si
mov word [r8], ax
add eax, 1
cmp eax, r10d
jne 0x6debd0
mov dword [rbx + 0x94], eax
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x9c], 2
jmp 0x6deb80
mov eax, dword [rbx + 0x94]
mov dword [rbx + 0x1708], r8d
mov dword [rbx + 0x88], 2
mov dword [rbx + 0x90], 0
add eax, r8d
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x84], eax
movabs rax, 0x200000000
mov qword [rbx + 0x9c], rax
mov eax, dword [rsp + 0x2c]
mov qword [rsi], rbp
mov dword [rsi + 8], eax
xor eax, eax
mov dword [rbx + 0x2c], edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0xfffffffe
jmp 0x6dec78
Function at 0x6e5a50
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov r10d, 0x80000000
mov r11d, ecx
test ecx, ecx
je 0x6e5ac9
mov ebx, 3
lea rsi, [0x0240b000]
jmp 0x6e5a78
add ebx, 1
sar r11d, 1
je 0x6e5ac9
test r11b, 1
je 0x6e5a70
mov eax, ebx
mov edx, 0x80000000
and eax, 0x1f
mov r9d, dword [rsi + rax*4]
mov eax, r10d
xor r10d, r10d
jmp 0x6e5ab1
mov r8d, eax
shr eax, 1
mov ecx, eax
and r8d, 1
shr edx, 1
xor ecx, 0xedb88320
test r8d, r8d
cmovne eax, ecx
test r9d, edx
je 0x6e5a98
lea ecx, [rdx - 1]
xor r10d, eax
test ecx, r9d
jne 0x6e5a98
add ebx, 1
sar r11d, 1
jne 0x6e5a78
mov eax, r10d
pop rbx
pop rsi
ret
Function at 0x70d780
Capabilities:
Create pipe
Reference absolute stream path on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2a8
lea r12, [rsp + 0x60]
mov rbp, rcx
mov ebx, edx
mov rdi, r8
mov qword [rsp + 0x58], 0
mov esi, r9d
mov rcx, r12
lea r13, [rsp + 0x58]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov r14, qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test eax, eax
je 0x70d800
call fcn.012341f0
xor r12d, r12d
mov rcx, r13
call r14
mov eax, r12d
add rsp, 0x2a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
mov rdx, r13
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov r14, qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov r12d, eax
test eax, eax
jne 0x70d7d7
lea r10, [rsp + 0x90]
mov r9, qword [rsp + 0x58]
mov edx, 0x104
lea r8, str..pipehaskell:process:_ls_n
mov rcx, r10
mov qword [rsp + 0x48], r10
call sub.msvcrt.dll_swprintf_s
cmp eax, 0xffffffff
je 0x70d7d7
mov rcx, r13
call r14
cmp ebx, 1
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x80], 0
sbb edx, edx
mov dword [rsp + 0x80], ebx
lea rbx, [rsp + 0x70]
mov r9d, 1
and edx, 0x40000000
mov qword [rsp + 0x38], rbx
mov rcx, r10
mov r8d, 0xe
mov qword [rsp + 0x70], 0
add edx, 0x80001
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x70], 0x18
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x70d7d7
cmp esi, 1
mov r10, qword [rsp + 0x48]
mov r9, rbx
mov edx, 0x40000000
sbb eax, eax
mov dword [rsp + 0x80], esi
mov r8d, 2
and eax, 0x3fffff80
mov dword [rsp + 0x20], 3
mov rcx, r10
mov qword [rsp + 0x30], 0
sub eax, 0xffffff80
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x70d998
lea rdx, [rsp + 0x54]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x54], 2
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov r12d, eax
test eax, eax
jne 0x70d968
call fcn.012341f0
mov rcx, r13
call r14
mov rcx, r15
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, rsi
call rbx
jmp 0x70d7e5
mov rbx, qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
mov edx, 3
mov rcx, r15
mov r12d, 1
call rbx
mov edx, 3
mov rcx, rsi
call rbx
mov qword [rbp], r15
mov qword [rdi], rsi
jmp 0x70d7e5
call fcn.012341f0
mov rcx, r13
call r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x70d7e5
Function at 0x70d9c0
Capabilities:
Create pipe

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov esi, dword [rsp + 0xc0]
test esi, esi
mov rbp, r8
mov rdi, rcx
mov r12, rdx
mov r13, r8
cmovne rbp, r9
mov rbx, r9
cmp rdx, 0xffffffffffffffff
je 0x70da80
cmp rdx, 0xfffffffffffffffe
je 0x70da60
cmp rdx, qword [rsp + 0xb0]
je 0x70dab8
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rsi
mov rbx, rax
call rsi
mov dword [rsp + 0x30], 2
mov r9, rbp
mov r8, rbx
mov dword [rsp + 0x28], 1
mov rcx, rax
mov rdx, r12
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x70daa4
mov rax, qword [rbp]
mov qword [rdi], rax
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rcx], 0
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rsp + 0xc8]
test edx, edx
je 0x70dad0
mov edx, dword [rsp + 0xb8]
mov r9d, esi
mov r8, rbx
mov rcx, r13
call fcn.0070d780
test eax, eax
jne 0x70da42
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 1
mov qword [rcx], rdx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x70db68
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x70db48
mov qword [r13], rcx
mov rcx, qword [rsp + 0x48]
test esi, esi
jne 0x70db28
mov qword [rbx], rcx
jmp 0x70da42
mov r8d, 1
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x70db88
mov rcx, qword [rsp + 0x48]
jmp 0x70db19
mov r8d, 1
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x70db88
mov rcx, qword [rsp + 0x40]
jmp 0x70db0c
call fcn.012341f0
mov qword [r13], 0
xor eax, eax
mov qword [rbx], 0
jmp 0x70da6c
call fcn.012341f0
mov qword [r13], 0
mov rcx, qword [rsp + 0x40]
mov qword [rbx], 0
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
xor eax, eax
jmp 0x70da6c
Function at 0x70e300
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
sub rsp, 0x30
mov edx, 1
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r12d, eax
test eax, eax
je 0x70e330
xor r12d, r12d
mov eax, r12d
add rsp, 0x30
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
cmp eax, 5
jne 0x70e35a
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x70e35a
cmp dword [rsp + 0x2c], 0x103
jne 0x70e322
mov r12d, 0xffffffff
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.012341f0
mov eax, r12d
add rsp, 0x30
pop r12
pop r13
pop r14
ret

Function at 0x77f120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rdi
push rsi
push rbx
mov r10, rdx
not r8d
cmp rdx, 8
jbe 0x77f21e
test cl, 7
je 0x77f16a
mov rdx, qword [0x024a5980]
lea rax, [rcx + r10]
nop dword [rax]
movzx r9d, byte [rcx]
add rcx, 1
mov r10, rax
sub r10, rcx
xor r9d, r8d
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rdx + r9*4]
test cl, 7
jne 0x77f148
mov rbx, r10
and r10d, 7
and rbx, 0xfffffffffffffff8
lea r14, [rbx + rcx]
cmp r14, rcx
jbe 0x77f21e
mov rdx, qword [0x024a5980]
mov r11, rcx
nop dword [rax]
mov r9d, dword [r11 + 4]
mov eax, dword [r11]
add r11, 8
mov edi, r9d
xor eax, r8d
movzx r8d, r9b
mov ebx, r9d
shr edi, 0x18
mov r8d, dword [rdx + r8*4 + 0xc00]
mov esi, eax
shr r9d, 0x10
xor r8d, dword [rdx + rdi*4]
movzx edi, al
shr esi, 0x10
movzx r9d, r9b
xor r8d, dword [rdx + rdi*4 + 0x1c00]
mov edi, eax
movzx esi, sil
movzx eax, ah
shr edi, 0x18
xor r8d, dword [rdx + rdi*4 + 0x1000]
movzx edi, bh
xor r8d, dword [rdx + rdi*4 + 0x800]
xor r8d, dword [rdx + r9*4 + 0x400]
xor r8d, dword [rdx + rax*4 + 0x1800]
xor r8d, dword [rdx + rsi*4 + 0x1400]
cmp r14, r11
ja 0x77f190
mov rax, rcx
not rax
lea rbx, [r14 + rax]
shr rbx, 3
lea rcx, [rcx + rbx*8 + 8]
test r10, r10
je 0x77f24c
mov rdx, qword [0x024a5980]
add r10, rcx
nop dword [rax]
movzx r9d, byte [rcx]
add rcx, 1
xor r9d, r8d
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rdx + r9*4]
cmp rcx, r10
jne 0x77f230
mov eax, r8d
not eax
pop rbx
pop rsi
pop rdi
pop r14
ret
Function at 0x77f260
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r10, rcx
mov rbx, rdx
not r8
cmp rdx, 4
jbe 0x77f32d
test cl, 3
je 0x77f364
mov r11, qword [0x024a5990]
add rcx, rdx
nop dword [rax + rax]
movzx edx, byte [r10]
add r10, 1
mov rax, rcx
sub rax, r10
xor edx, r8d
shr r8, 8
movzx edx, dl
xor r8, qword [r11 + rdx*8]
test r10b, 3
jne 0x77f290
mov rsi, rax
and eax, 3
and rsi, 0xfffffffffffffffc
mov rbx, rax
add rsi, r10
cmp rsi, r10
jbe 0x77f32d
mov r11, qword [0x024a5990]
mov r9, r10
nop dword [rax]
mov edx, dword [r9]
add r9, 4
xor edx, r8d
shr r8, 0x20
mov eax, edx
movzx ecx, dl
shr eax, 0x18
mov rcx, qword [r11 + rcx*8 + 0x1800]
xor rcx, qword [r11 + rax*8]
movzx eax, dh
shr edx, 0x10
movzx edx, dl
xor r8, rcx
xor r8, qword [r11 + rax*8 + 0x1000]
xor r8, qword [r11 + rdx*8 + 0x800]
cmp rsi, r9
ja 0x77f2d8
mov rax, r10
not rax
add rsi, rax
shr rsi, 2
lea r10, [r10 + rsi*4 + 4]
test rbx, rbx
je 0x77f35b
mov r11, qword [0x024a5990]
lea rax, [r10 + rbx]
nop dword [rax]
movzx edx, byte [r10]
add r10, 1
xor edx, r8d
shr r8, 8
movzx edx, dl
xor r8, qword [r11 + rdx*8]
cmp r10, rax
jne 0x77f340
mov rax, r8
not rax
pop rbx
pop rsi
ret
mov rax, rdx
jmp 0x77f2b2
Function at 0x78c490
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rcx + 0x18]
mov esi, dword [rsp + 0x50]
lea ebp, [r9 - 2]
mov r11, rdx
lea rdx, [rbx + 1]
mov rax, rcx
cmp ebp, 7
jbe 0x78c5d0
lea ebp, [r9 - 0xa]
mov dword [rcx + rbx*4 + 0x28], 1
lea r10, [rbx + 2]
mov qword [rcx + rbx*8 + 0x110], r11
mov qword [rcx + 0x18], rdx
lea rdx, [r11 + 2]
cmp ebp, 7
ja 0x78c550
mov dword [rcx + rbx*4 + 0x2c], 0
lea r9, [rbx + 3]
mov edi, 1
mov qword [rcx + rbx*8 + 0x118], rdx
mov edx, r8d
mov ecx, 3
shl rdx, 4
lea r12, [rdx + 0x104]
nop word cs:[rax + rax]
mov r10d, edi
sub ecx, 1
mov edx, ebp
shr edx, cl
lea r10, [r12 + r10*2]
and edx, 1
add r10, r11
mov dword [rax + r9*4 + 0x24], edx
lea edi, [rdx + rdi*2]
mov qword [rax + r9*8 + 0x108], r10
add r9, 1
test ecx, ecx
jne 0x78c510
add rbx, 5
mov qword [rax + 0x18], rbx
jmp 0x78c5b2
mov dword [rcx + rbx*4 + 0x2c], 1
lea edi, [r9 - 0x12]
lea r12, [r11 + 0x204]
mov r9d, 1
mov qword [rcx + rbx*8 + 0x118], rdx
mov ecx, 8
nop word cs:[rax + rax]
sub ecx, 1
mov edx, edi
mov ebp, r9d
shr edx, cl
lea rbp, [r12 + rbp*2]
and edx, 1
mov dword [rax + r10*4 + 0x28], edx
lea r9d, [rdx + r9*2]
mov qword [rax + r10*8 + 0x110], rbp
add r10, 1
test ecx, ecx
jne 0x78c580
add rbx, 0xa
mov qword [rax + 0x18], rbx
test sil, sil
jne 0x78c5c9
mov edx, r8d
add rdx, 0x1200
sub dword [r11 + rdx*4 + 8], 1
je 0x78c640
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r12d, r8d
lea r9, [rbx + 2]
mov edi, 1
mov dword [rcx + rbx*4 + 0x28], 0
shl r12, 4
mov qword [rcx + rbx*8 + 0x110], r11
mov ecx, 3
add r12, 4
nop dword [rax]
mov r10d, edi
sub ecx, 1
mov edx, ebp
shr edx, cl
lea r10, [r12 + r10*2]
and edx, 1
add r10, r11
mov dword [rax + r9*4 + 0x24], edx
lea edi, [rdx + rdi*2]
mov qword [rax + r9*8 + 0x108], r10
add r9, 1
test ecx, ecx
jne 0x78c600
add rbx, 4
mov qword [rax + 0x18], rbx
jmp 0x78c5b2
mov edx, r8d
mov rcx, r11
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0078c140
Function at 0x78da70
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r11d, 8
mov r10d, dword [rsp + 0x30]
mov rax, rcx
mov ecx, dword [rcx + 0xb94]
and edx, dword [rax + 0xb98]
sub r11d, ecx
shl edx, cl
mov ecx, r11d
shr r8d, cl
add edx, r8d
lea rdx, [rdx + rdx*2]
shl rdx, 9
lea rbx, [rax + rdx + 0xb9c]
mov eax, dword [rsp + 0x38]
add eax, 0x100
test r9b, r9b
je 0x78db20
mov r11, qword [0x024a5a80]
mov r8d, 0x100
xor r9d, r9d
nop word [rax + rax]
add r10d, r10d
mov edx, eax
mov ecx, r8d
and ecx, r10d
shr edx, 8
add edx, ecx
mov ecx, eax
add eax, eax
add edx, r8d
shl ecx, 0x18
movzx edx, word [rbx + rdx*2]
sar ecx, 0x1f
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [r11 + rdx]
add r9d, edx
mov edx, r10d
xor edx, eax
not edx
and r8d, edx
cmp eax, 0xffff
jbe 0x78dad0
mov eax, r9d
pop rbx
ret
mov r11, qword [0x024a5a80]
xor r9d, r9d
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
mov edx, eax
movzx edx, word [rbx + rdx*2]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [r11 + rdx]
add r9d, edx
cmp eax, 1
jne 0x78db30
mov eax, r9d
pop rbx
ret