joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011300
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18004f0b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180011350
test eax, eax
je 0x18001141a
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180011370
mov eax, dword [0x180035b4c]
lea rdx, [rsp + 0x20]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x180011390
xor r8d, r8d
nop
movzx ecx, word [rdi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x1800113a0
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800113c0
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800113e6
lea rcx, [rsp + 0x20]
call fcn.180011220
cmp word [rsp + 0x20], 0
jne 0x1800113f2
xor ebx, ebx
jmp 0x18001140a
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180011400
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180008580
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180019490
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180011890
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
xor bl, bl
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx ecx, bl
mov edx, 1
test eax, eax
cmovne ecx, edx
movzx eax, cl
add rsp, 0x20
pop rbx
ret
Function at 0x180011b50
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18004f0b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.18001c150
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x180011bbf
mov r8d, ebx
jmp 0x180011bcc
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x180011bc2
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180008580
nop
lea rcx, [rsp + 0x28]
call fcn.180012cd0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180011d2a
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180011d20
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x180011c37
mov r8, rbx
jmp 0x180011c4b
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180011c40
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180008580
nop
lea rcx, [rsp + 0x48]
call fcn.180012cd0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x180011cca
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x180011cbb
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x180011cca
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x180011ccf
jne 0x180011ca5
mov r8d, ebx
test r8d, r8d
jne 0x180011cdb
cmp r11, r10
jb 0x180011cdb
jbe 0x180011d04
cmp r9, 8
jb 0x180011cf2
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180008740
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180011c10
mov ebx, 1
cmp r9, 8
jb 0x180011d20
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180008740
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180011d47
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180008740
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180019490
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180012050
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180012194
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180012189
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180012139
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x18001218e
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x180012140
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180014d90
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180014dbe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180015ce0
cmp byte [0x180051870], 0
jne 0x180014e09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180014df9
lea rdx, [0x180037998]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180051868], rax
mov byte [0x180051870], 1
jmp 0x180014e10
mov rax, qword [0x180051868]
mov byte [0x180051870], 1
jmp 0x180014e10
mov rax, qword [0x180051868]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180014e2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180015d54
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180015d76
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015d76
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180015d76
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180015b90
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x18004f0b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.1800156f0
mov ebx, eax
test eax, eax
jne 0x180015ca7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180015c81
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180015b90
mov ebx, eax
test eax, eax
jne 0x180015ca7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180015c30
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180015c96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.180014d90
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180015cb7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180019490
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015ce0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180014dbe
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180015ce0
cmp byte [0x180051870], 0
jne 0x180014e09
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180014df9
lea rdx, [0x180037998]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180051868], rax
mov byte [0x180051870], 1
jmp 0x180014e10
mov rax, qword [0x180051868]
mov byte [0x180051870], 1
jmp 0x180014e10
mov rax, qword [0x180051868]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x180014e2f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180015d54
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180015d76
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015d76
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180015d76
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180015f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x18004f0b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18001600e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18001600e
call fcn.180014780
mov ebx, eax
jmp 0x180016136
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18001602f
call fcn.180014780
jmp 0x180016125
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180016052
call fcn.180014780
jmp 0x180016125
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180016074
mov ebx, 0x8007000e
jmp 0x180016127
mov ecx, eax
test eax, eax
je 0x1800160ac
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x1800160a2
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800160ac
lea rcx, [rsp + 0x70]
call fcn.180014670
jmp 0x1800160b6
mov ecx, 0x80070216
call fcn.180014970
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1800160c9
cmp qword [rsp + 0x70], 0
jne 0x1800160d8
mov ebx, 0x8007000e
jmp 0x180016127
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180016102
call fcn.180014780
jmp 0x180016125
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180015d90
mov ebx, eax
test rdi, rdi
je 0x180016136
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18001614d
lea rcx, [rsp + 0x70]
call fcn.180014e80
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180019490
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800168e0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180016920
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x180016938
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x180016944
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x180016940
mov rcx, qword [rcx]
mov rdx, r10
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x35ec770
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x35ec77d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x35ec78d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x35ec775
lea eax, [rcx + 1]
jmp 0x35ec79b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x35ec7ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x35ec794
sub eax, 3
jb 0x35ec7ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x35ec81d
sar eax, 1
movsxd rbp, eax
jb 0x35ec804
jmp 0x35ec7dc
add ebx, ebx
jne 0x35ec7da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x35ec804
inc ecx
add ebx, ebx
jne 0x35ec7ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x35ec804
call r11
adc ecx, ecx
add ebx, ebx
jne 0x35ec7fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x35ec7ec
add ecx, 2
jmp 0x35ec809
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.035ec732
jmp 0x35ec77d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3192000]
mov eax, dword [rdi]
or eax, eax
je 0x35ec879
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x32166c8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x35ec829
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x35ec873
mov qword [rbx], rax
add rbx, 8
jmp 0x35ec849
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x35ec8bd
cmp al, 0xef
ja 0x35ec8a5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x35ec885
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x35ec894
mov eax, dword [rdi]
add rdi, 4
jmp 0x35ec894
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x35ec911
sub rsp, 0xffffffffffffff80
jmp 0x1445310
Function at 0x140003660
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400036bd
lea rbx, [0x1400512b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400036a4
cmp r10, 2
jb 0x1400036a4
cmp byte [r9], r8b
jne 0x1400036a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003680
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400036ff
lea rbx, [0x1400512b0]
cmp r8b, 0x23
jne 0x1400036e3
cmp byte [r9], r8b
jne 0x1400036e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400036d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400038c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1400038ef
mov r8d, 0x78d
lea rdx, [0x14004ba70]
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rsi, rsi
je 0x1400038fb
mov qword [rsi], 0
lea rdx, [0x140050b08]
mov rcx, rbx
call fcn.140003710
mov rbx, rax
test rax, rax
jne 0x14000391d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003a08
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003a08
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003a08
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003a08
cmp rdi, 0xffffffffffffffff
je 0x140003a08
mov rax, qword [0x1402bdeb8]
test rax, rax
je 0x140003999
inc dword [rax + 0xf4]
mov rdx, qword [0x1402bdea8]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
test rax, rax
je 0x140003a08
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400039f5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402bdeb8]
test rax, rax
je 0x1400039e4
dec dword [rax + 0xf4]
mov rdx, qword [0x1402bdea8]
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140003a11
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140003a03
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140003a13
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140006db0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xe8]
mov rbx, rcx
movsxd rdi, edx
test eax, eax
jg 0x140006dee
mov r8d, 0x707
lea rdx, [0x14004b890]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0xe8]
movsxd rcx, eax
lea rdx, [0x1400512b0]
mov rax, qword [rbx + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x1402bdeb8]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140006e68
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001dc10
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006e80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0xe8]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x140006eba
mov r8d, 0x707
lea rdx, [0x14004b890]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0xe8]
movss xmm2, dword [rbx + 0x108]
lea r9, [0x1400512b0]
movss xmm0, dword [rdi]
movss xmm3, dword [rbx + 0x10c]
subss xmm0, xmm2
movss xmm1, dword [rdi + 4]
movsxd rcx, eax
subss xmm1, xmm3
mov rax, qword [rbx + 0xf0]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rdi + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movzx eax, byte [rsp + 0x20]
not r8d
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret