joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045050
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x818]
sub rsp, 0x900
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rsi, rdx
mov rdi, rcx
or r8d, 0xffffffff
xor r14d, r14d
mov ebx, r14d
mov r9d, r14d
nop word [rax + rax]
test r8b, 1
je 0x1400450b7
mov ecx, 0x1f
sub cl, r9b
mov edx, 1
shl edx, cl
or ebx, edx
shr r8d, 1
test r8b, 1
je 0x1400450d1
mov ecx, 0x1e
sub cl, r9b
mov edx, 1
shl edx, cl
or ebx, edx
shr r8d, 1
add r9, 2
cmp r9, 0x20
jb 0x1400450a0
call fcn.140045b10
mov rax, qword [rdi + 0x40]
lea rdx, [rdi + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x1400450f5
mov rdx, qword [rdx]
lea r8, [rdx + rax*2]
cmp rdx, r8
jae 0x14004512b
lea r9, [0x14023a5b0]
nop word [rax + rax]
movzx eax, byte [rdx]
xor al, bl
movzx ecx, al
mov eax, ebx
shr eax, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, eax
inc rdx
cmp rdx, r8
jb 0x140045110
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x368], r14
mov qword [rbp + 0x368], 7
mov qword [rbp + 0x360], r14
mov word [rbp + 0x350], r14w
mov r8d, 5
lea rdx, str..list
lea rcx, [rbp + 0x350]
call fcn.14000dc20
nop
not ebx
mov r8d, 0xa
lea rdx, [rbp + 0x7b0]
mov ecx, ebx
call fcn.14016a480
mov rdx, rax
lea r8, [rbp + 0x350]
lea rcx, [rbp + 0x370]
call fcn.140045620
nop
cmp qword [rax + 0x18], 8
jb 0x1400451a4
mov rax, qword [rax]
mov r8, rax
mov edx, 0x208
lea rcx, [rbp + 0x5a0]
call fcn.140007f00
mov edx, 0x104
lea rcx, [rbp + 0x390]
lea r8, str.lists
lea rax, [rbp + 0x390]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140045204
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140045204
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400451e0
jmp 0x140045209
test rdx, rdx
jne 0x14004520d
sub rcx, 2
mov word [rcx], r14w
lea rcx, [rbp + 0x140]
call fcn.140007df0
mov rcx, rax
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x30]
call fcn.140007bf0
mov rcx, rax
lea r8, [rbp + 0x5a0]
mov rdx, rsi
call fcn.140007bf0
nop
cmp qword [rbp + 0x388], 8
jb 0x14004525a
mov rcx, qword [rbp + 0x370]
call fcn.1401669a0
mov qword [rbp + 0x388], 7
mov qword [rbp + 0x380], r14
mov word [rbp + 0x370], r14w
cmp qword [rbp + 0x368], 8
jb 0x14004528a
mov rcx, qword [rbp + 0x350]
call fcn.1401669a0
mov qword [rbp + 0x368], 7
mov qword [rbp + 0x360], r14
mov word [rbp + 0x350], r14w
mov rax, rsi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400452d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x818]
sub rsp, 0x900
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov rsi, rdx
mov rdi, rcx
or r8d, 0xffffffff
xor r14d, r14d
mov ebx, r14d
mov r9d, r14d
nop word [rax + rax]
test r8b, 1
je 0x140045337
mov ecx, 0x1f
sub cl, r9b
mov edx, 1
shl edx, cl
or ebx, edx
shr r8d, 1
test r8b, 1
je 0x140045351
mov ecx, 0x1e
sub cl, r9b
mov edx, 1
shl edx, cl
or ebx, edx
shr r8d, 1
add r9, 2
cmp r9, 0x20
jb 0x140045320
call fcn.140045b10
mov rax, qword [rdi + 0x40]
lea rdx, [rdi + 0x30]
cmp qword [rdx + 0x18], 8
jb 0x140045375
mov rdx, qword [rdx]
lea r8, [rdx + rax*2]
cmp rdx, r8
jae 0x1400453ab
lea r9, [0x14023a5b0]
nop word [rax + rax]
movzx eax, byte [rdx]
xor al, bl
movzx ecx, al
mov eax, ebx
shr eax, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, eax
inc rdx
cmp rdx, r8
jb 0x140045390
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x368], r14
mov qword [rbp + 0x368], 7
mov qword [rbp + 0x360], r14
mov word [rbp + 0x350], r14w
mov r8d, 9
lea rdx, str..list.tmp
lea rcx, [rbp + 0x350]
call fcn.14000dc20
nop
not ebx
mov r8d, 0xa
lea rdx, [rbp + 0x7b0]
mov ecx, ebx
call fcn.14016a480
mov rdx, rax
lea r8, [rbp + 0x350]
lea rcx, [rbp + 0x370]
call fcn.140045620
nop
cmp qword [rax + 0x18], 8
jb 0x140045424
mov rax, qword [rax]
mov r8, rax
mov edx, 0x208
lea rcx, [rbp + 0x5a0]
call fcn.140007f00
mov edx, 0x104
lea rcx, [rbp + 0x390]
lea r8, str.lists
lea rax, [rbp + 0x390]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140045484
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140045484
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140045460
jmp 0x140045489
test rdx, rdx
jne 0x14004548d
sub rcx, 2
mov word [rcx], r14w
lea rcx, [rbp + 0x140]
call fcn.140007df0
mov rcx, rax
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x30]
call fcn.140007bf0
mov rcx, rax
lea r8, [rbp + 0x5a0]
mov rdx, rsi
call fcn.140007bf0
nop
cmp qword [rbp + 0x388], 8
jb 0x1400454da
mov rcx, qword [rbp + 0x370]
call fcn.1401669a0
mov qword [rbp + 0x388], 7
mov qword [rbp + 0x380], r14
mov word [rbp + 0x370], r14w
cmp qword [rbp + 0x368], 8
jb 0x14004550a
mov rcx, qword [rbp + 0x350]
call fcn.1401669a0
mov qword [rbp + 0x368], 7
mov qword [rbp + 0x360], r14
mov word [rbp + 0x350], r14w
mov rax, rsi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140045b10
Capabilities:
Encrypt data using rc4 prga
Hash data using crc32b

Disassembly:
sub rsp, 8
cmp byte [0x14023a5a0], 0
jne 0x140045c04
mov qword [rsp], rbx
xor r10b, r10b
lea r11, [0x14023a5b0]
mov ebx, 0x80
xor eax, eax
movzx ecx, bl
nop dword [rax]
test r10b, cl
je 0x140045b49
btc eax, 0x1f
test eax, eax
jns 0x140045b56
add eax, eax
xor eax, 0x4c11db7
jmp 0x140045b58
add eax, eax
shr cl, 1
jne 0x140045b40
xor r9d, r9d
xor r8d, r8d
test al, 1
je 0x140045b78
mov ecx, 0x1f
mov edx, 1
sub cl, r8b
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x140045b90
mov ecx, 0x1e
mov edx, 1
sub cl, r8b
shl edx, cl
or r9d, edx
add r8, 2
shr eax, 1
cmp r8, 0x20
jb 0x140045b62
xor al, al
test r10b, 1
movzx ecx, r10b
movzx eax, al
cmovne eax, ebx
shr cl, 1
test cl, 1
je 0x140045bb5
or al, 0x40
shr cl, 1
test cl, 1
je 0x140045bbe
or al, 0x20
shr cl, 1
test cl, 1
je 0x140045bc7
or al, 0x10
shr cl, 1
test cl, 1
je 0x140045bd0
or al, 8
shr cl, 1
test cl, 1
je 0x140045bd9
or al, 4
shr cl, 1
test cl, 1
je 0x140045be2
or al, 2
test cl, 2
je 0x140045be9
or al, 1
movzx eax, al
mov dword [r11 + rax*4], r9d
inc r10b
jne 0x140045b34
mov rbx, qword [rsp]
mov byte [0x14023a5a0], 1
add rsp, 8
ret
Function at 0x14004d5d0
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1a8], rbx
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
dec edx
je 0x14004d790
sub edx, 0x4bd
je 0x14004d730
dec edx
je 0x14004d708
cmp edx, 3
jne 0x14004d7d0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
lea r8d, [rdx + 0x2f]
lea rdx, str.https:__www.iblocklist.com_peerblock_renew_srcpbw
lea rcx, [rsp + 0x38]
call fcn.14000dc20
nop
cmp qword [0x140239bc0], rbx
je 0x14004d6da
lea rdx, str.username_1_
lea rcx, [rbp - 0x80]
call fcn.140021a10
nop
lea rdx, [0x140239bb0]
mov rcx, rax
call fcn.14000cbd0
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.14000d8f0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000d720
nop
cmp qword [rsp + 0x70], 8
jb 0x14004d6be
mov rcx, qword [rsp + 0x58]
call fcn.1401669a0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
lea rcx, [rbp - 0x80]
call fcn.1400090e0
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x14004d769
mov dword [rsp + 0x28], 5
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.https:__www.iblocklist.com_peerblock_subscribe.php_srcpbw
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14004d7d0
lea rcx, [rsp + 0x38]
call fcn.14004d4a0
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], 5
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp qword [rsp + 0x50], 8
jb 0x14004d77b
mov rcx, qword [rsp + 0x38]
call fcn.1401669a0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
jmp 0x14004d7d0
cmp dword [0x1402391ec], 0
je 0x14004d7c2
mov edx, 0x4c1
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x14004d7c2
mov byte [0x140239bf0], al
lea rdx, str.peerblock.conf
lea rcx, [0x140239840]
call fcn.140014180
mov edx, 1
mov rcx, rbx
call qword [sym.imp.USER32.dll_EndDialog]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140166980
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
Function at 0x140057330
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov edi, r8d
mov r9, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov qword [rax + 0x10], rdx
mov qword [rdx], 0
mov rax, qword [r9]
test rax, rax
je 0x1400573a3
mov qword [rdx], rax
test al, 1
je 0x140057391
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [r9 + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [r9 + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
jmp 0x1400573a3
and rax, 0xfffffffffffffffe
add rdx, 8
lea rcx, [r9 + 8]
xor r8d, r8d
call qword [rax]
nop
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], ecx
mov r9, rbx
lea r8, [0x1400572c0]
xor edx, edx
xor ecx, ecx
call fcn.14016a50c
mov qword [rbx], rax
test rax, rax
jne 0x14005741e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x38]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rsp + 0x38], rax
lea rax, str._beginthreadex
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], ebx
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x38]
call fcn.140170da8
int3
test edi, edi
je 0x140057437
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14006d0b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rdx + 0x18], 8
mov r9, qword [rdx + 0x10]
mov r8, rdx
jb 0x14006d0ca
mov r8, qword [rdx]
xor edx, edx
movabs rax, 0xcbf29ce484222325
add r9, r9
je 0x14006d104
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r9
jb 0x14006d0f0
mov rcx, rax
mov edx, 0x1f31d
shr rcx, 0x20
xor ecx, eax
btr ecx, 0x1f
call fcn.14016ca50
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x30]
shr rax, 0x20
imul eax, eax, 0x41a7
imul ecx, ecx, 0xb14
sub eax, ecx
jns 0x14006d13d
add eax, 0x7fffffff
cdqe
add rsp, 0x28
ret
Function at 0x140076e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea r8, [0x1401db368]
mov edx, WSACleanup
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov edx, edi
mov ecx, 2
mov rsi, rax
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, ebx
mov rdx, rsi
mov rcx, rax
call fcn.1401669c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14007aad0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x14007ad04
cmp byte [rcx + 0x82], 0
je 0x14007ad04
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x14007ab35
xor al, al
jmp 0x14007ad06
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp r15, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x14007abc4
dec eax
jne 0x14007acbe
jmp 0x14007abcb
mov byte [rdi + 0x82], 0
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp - 0x40]
sub rbx, rax
je 0x14007ac19
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.140168220
cmp rbx, rax
jne 0x14007acc3
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x82], 0
je 0x14007ace1
test rbx, rbx
jne 0x14007ab80
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x20]
sub rax, r8
cmp rax, 8
jbe 0x14007acd4
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x14007acc7
cmp r9, rbx
jae 0x14007ac69
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.140001dc0
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
jmp 0x14007ac85
test rbx, rbx
jne 0x14007ac8e
mov qword [rbp - 0x20], r14
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], bl
jmp 0x14007ab6f
test rbx, rbx
je 0x14007ab80
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov rax, qword [rbp - 0x20]
xor edx, edx
mov qword [rax + rcx], rdx
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov byte [rbx + rax], dl
jmp 0x14007ab6f
sub eax, 2
je 0x14007ace1
xor bl, bl
jmp 0x14007ace3
lea rcx, str.string_too_long
call fcn.140144f6c
int3
lea rcx, str.string_too_long
call fcn.140144f6c
int3
mov bl, 1
cmp qword [rbp - 0x18], 0x10
jb 0x14007acf3
mov rcx, qword [rbp - 0x30]
call fcn.1401669a0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x14007ad06
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14007b870
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rbx, rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 7
xor esi, esi
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
lea r8d, [rsi + 0x31]
lea rdx, str._UpdateThread___GetFileSize_____Entering_routine.
lea rcx, [rsp + 0x40]
call fcn.14000dc20
nop
lea r8d, [rsi + 6]
lea rdx, [rsp + 0x40]
call fcn.140078560
mov r9, rbx
lea r8, str._UpdateThread___GetFileSize_____file:___s_
mov edx, 0x200
lea rcx, [rbp - 0x80]
call fcn.140167410
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp word [rbp - 0x80], si
jne 0x14007b92e
mov r8d, esi
jmp 0x14007b94b
lea rax, [rbp - 0x80]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14007b940
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.14000dc20
nop
mov r8d, 5
lea rdx, [rsp + 0x40]
call fcn.140078560
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007b9df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rsp + 0x40], rax
lea rax, str.CreateFile
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], ebx
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x40]
call fcn.140170da8
int3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14007ba37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x40]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rsp + 0x40], rax
lea rax, [0x1401dbcd8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x68], ebx
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x40]
call fcn.140170da8
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
mov r8d, 0x30
lea rdx, str._UpdateThread___GetFileSize_____Leaving_routine.
lea rcx, [rsp + 0x40]
call fcn.14000dc20
nop
mov r8d, 6
lea rdx, [rsp + 0x40]
call fcn.140078560
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140083110
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, qword [r8]
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rbx, rbx
jne 0x14008313e
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov qword [rsp + 0x58], r15
mov qword [r8], rbp
mov r15d, 0x400000
nop word [rax + rax]
mov rcx, qword [r14]
mov r8d, ebx
cmp rbx, r15
lea r9, [rsp + 0x60]
mov rdx, rsi
cmova r8d, r15d
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x60]
add qword [rdi], rdx
add rsi, rdx
sub rbx, rdx
test eax, eax
je 0x1400831a2
test edx, edx
je 0x14008319e
test rbx, rbx
jne 0x140083160
xor eax, eax
jmp 0x1400831a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400833c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
lea r10, [0x14023bb80]
xor eax, eax
mov r8, r10
mov edx, eax
mov ecx, eax
inc eax
shr ecx, 1
and edx, 1
lea r8, [r8 + 4]
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [r8 - 4], ecx
cmp eax, 0x100
jb 0x1400833d2
cmp eax, 0x800
jae 0x1400834ba
lea r9, [r10 + rax*4]
nop dword [rax]
lea ecx, [rax - 0x100]
inc eax
lea r9, [r9 + 4]
mov r8d, dword [r10 + rcx*4]
movzx edx, r8b
shr r8d, 8
mov ecx, dword [r10 + rdx*4]
xor ecx, r8d
mov dword [r9 - 4], ecx
cmp eax, 0x800
jb 0x140083490
lea rbx, [0x140086cd0]
call fcn.140086dd0
lea rcx, [0x140086dc0]
test eax, eax
cmove rbx, rcx
mov qword [0x14023a1d8], rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140087f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r8d, dword [r9]
xor ebp, ebp
mov r14, r9
and r8d, 7
mov rsi, rcx
mov r10d, ebp
cmp rdx, 5
jae 0x140087f5b
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
lea rbx, [rdx - 4]
mov qword [rsp + 0x28], r15
or rdi, 0xffffffffffffffff
add rbx, rcx
lea r15, [0x140000000]
nop dword [rax]
lea r9, [r10 + rsi]
cmp r9, rbx
jae 0x140087fa2
nop dword [rax]
movzx eax, byte [r9]
and al, 0xfe
cmp al, 0xe8
je 0x140087fa2
inc r9
cmp r9, rbx
jb 0x140087f90
mov r10, r9
sub r10, rsi
mov rax, r10
sub rax, rdi
cmp r9, rbx
jae 0x1400880b0
cmp rax, 3
jbe 0x140087fdf
mov r8d, ebp
movzx ecx, byte [r9 + 4]
mov rdi, r10
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x140088024
and r8d, 3
add r8d, r8d
or r8d, 1
inc r10
jmp 0x140087f80
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
je 0x140087fc0
movzx eax, byte [r8 + r15 + 0x1bb048]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rcx + 4]
cmp byte [r8 + r15 + 0x1bb040], bpl
je 0x14008800e
inc al
test al, 0xfe
jne 0x140087fc0
and r8d, 3
mov rdi, r10
add r8d, r8d
or r8d, 1
inc r10
jmp 0x140087f80
movzx eax, cl
movzx ecx, byte [r9 + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [r9 + 1]
shl eax, 8
or eax, ecx
sub eax, r10d
lea edx, [rax - 5]
test r8d, r8d
je 0x140088082
mov eax, r8d
movzx r11d, byte [rax + r15 + 0x1bb048]
mov eax, edx
shl r11d, 3
neg r11d
lea ecx, [r11 + 0x18]
shr eax, cl
inc al
test al, 0xfe
jne 0x140088082
lea ecx, [r11 + 0x20]
mov eax, 1
shl eax, cl
dec eax
xor eax, edx
jmp 0x140088045
mov eax, edx
mov byte [r9 + 1], dl
shr eax, 0x18
and al, 1
dec al
not al
mov byte [r9 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r9 + 3], al
mov eax, edx
shr eax, 8
add r10, 5
mov byte [r9 + 2], al
jmp 0x140087f80
mov r15, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
cmp rax, 3
ja 0x1400880d2
lea ecx, [rax - 1]
shl r8d, cl
and r8d, 7
mov ebp, r8d
mov dword [r14], ebp
mov rbp, qword [rsp + 0x30]
mov rax, r10
pop r14
pop rsi
ret

Function at 0x14008bd10
Capabilities:
Read file on windows

Disassembly:
mov rcx, r8
mov r8d, r9d
mov r9, rdx
mov edx, 1
jmp fcn.14016968c

Function at 0x140093770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, r8d
mov rdi, rdx
lea ebx, [r8 - 1]
cdq
sub eax, edx
sar eax, 1
lea edx, [rax + 1]
call fcn.140090310
mov r10, rax
test rax, rax
je 0x14009380f
xor r11d, r11d
movsxd r9, ebx
test ebx, ebx
jle 0x1400937fc
dec r9
lea rbx, [rdi + 1]
shr r9, 1
inc r9
movsx edx, byte [rbx - 1]
movsx r8d, byte [rbx]
mov al, 7
mov ecx, r8d
lea rbx, [rbx + 2]
sar ecx, 6
and cl, 1
imul cl
mov ecx, edx
sar ecx, 6
sub r8b, al
and cl, 1
mov al, 7
and r8b, 0xf
imul cl
sub dl, al
mov eax, r11d
shl dl, 4
add r11d, 2
xor r8b, dl
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov byte [rcx + r10], r8b
dec r9
jne 0x1400937b0
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov rax, r10
mov byte [rcx + r10], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret