joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800282d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18027d040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800282fd
xor eax, eax
jmp 0x180028469
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180028337
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180028337
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180028469
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18002845c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002837a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800283a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180028461
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180028414
sub eax, 1
je 0x180028414
cmp eax, 2
jne 0x18002845c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180028461
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180028442
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18002845c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180028461
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180074910
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180028910
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18027d040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800289e3
cmp byte [rcx + 0x71], 0
je 0x1800289e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800289df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800289a4
sub eax, 1
je 0x1800289a8
cmp eax, 2
jne 0x1800289df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180074910
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800289d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800289df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18002898c
xor al, al
jmp 0x18002898c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180074910
add rsp, 0x60
pop rbx
ret
Function at 0x180029a70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x180029af7
mov rbx, r15
mov rbp, r15
jmp 0x180029b3a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x180029b11
cmp rbx, rcx
je 0x180029b34
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x180029b03
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 0x10], rax
jne 0x180029b58
lea rcx, [0x18007bef0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.180074930
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xor r13d, r13d
mov dword [rdi + 0x14], r13d
mov rdx, qword [rsi + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x180029b9a
cvtsi2ss xmm0, rdx
jmp 0x180029bb2
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x180029bc5
cvtsi2ss xmm1, rcx
jmp 0x180029bda
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x180029c41
mov rcx, rsi
call fcn.180019600
mov rdx, rax
mov rcx, rsi
call fcn.180019450
mov rdx, qword [rsi + 0x30]
and rdx, r12
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x180029c34
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x180029c31
nop
mov rbx, rax
cmp rax, rdx
je 0x180029c75
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180029c20
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x180029c7c
mov qword [rcx + rax*8], rdi
jmp 0x180029c8e
mov qword [rsp + 0x20], rax
jmp 0x180029c39
cmp r8, rbp
jne 0x180029c87
mov qword [rcx + rax*8], rdi
jmp 0x180029c93
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180029c93
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x180029b19
Function at 0x18002a3f0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18002a425
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180003240
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18002a594
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18002a50c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18002a583
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18002a549
mov r10, qword [rdx]
cmp r10, rax
je 0x18002a543
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18002a583
cmp r9, rdx
je 0x18002a55f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18002a5a5
cmp r9, rdx
jne 0x18002a550
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18002a490
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18002a583
Function at 0x18002b310
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18002b341
xor eax, eax
lea r8, [0x18002b0c0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18002cd10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002cd6d
lea rbx, [0x18007d250]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18002cd54
cmp r10, 2
jb 0x18002cd54
cmp byte [r9], r8b
jne 0x18002cd54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18002cd30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18002cdaf
lea rbx, [0x18007d250]
cmp r8b, 0x23
jne 0x18002cd93
cmp byte [r9], r8b
jne 0x18002cd93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18002cd80
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18002fa00
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r8, [0x18007d250]
movsxd rcx, dword [rcx + 0xd0]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x1802b4ba8]
not ebx
cmp dword [rcx + 0x3efc], ebx
jne 0x18002fa95
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.180041e20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18003c240
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18027d040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1802b4ba8]
mov edi, ecx
cmp byte [rbx + 0x426d], 0
jne 0x18003c2a1
cmp byte [rbx + 0x426e], 0
jne 0x18003c2a1
movsx r9d, word [rbx + 0x5352]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.18002cbd0
test dil, 1
je 0x18003c3c8
jmp 0x18003c32c
movss xmm1, dword [rbx + 0x38a0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5352]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x18026fe10]
mov edx, 0x10
mulss xmm1, dword [0x18026fdf0]
addss xmm0, dword [rbx + 0xd84]
addss xmm1, dword [rbx + 0xd88]
mov qword [rbx + 0x3fe8], rax
mov dword [rbx + 0x3fd4], 1
movss dword [rbx + 0x3fe0], xmm0
movss dword [rbx + 0x3fe4], xmm1
movss xmm0, dword [rbx + 0x3908]
mulss xmm0, dword [0x18026fd18]
or dword [rbx + 0x3fd0], 0x41
movss dword [rbx + 0x4030], xmm0
call fcn.18002cbd0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18003c380
lea r11, [0x18007d250]
nop dword [rax]
cmp r9b, 0x23
jne 0x18003c363
cmp byte [r8], r9b
jne 0x18003c363
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18003c350
not ecx
call fcn.180034b70
test rax, rax
je 0x18003c3c8
cmp byte [rax + 0x96], 0
je 0x18003c3c8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5352]
mov edx, 0x10
movsx r9d, word [rbx + 0x5352]
call fcn.18002cbd0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.180037440
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180074910
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x180040df0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5400], 0
lea rbx, [rcx + 0x5408]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180040e97
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180040e4a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180042b70
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.18002d870
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5400]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5410]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1802b4ae1]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180040e9f
mov rcx, rbx
call fcn.18002d870
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18007435c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180074396
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18007439b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800743e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180079870]
cmp byte [rcx + rax], 0
je 0x1800743e4
dec r8
sub rdx, 1
jne 0x1800743ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1407233e8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14072356f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140723419
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407233ff
add dl, dl
jne 0x140723426
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140723486
xor eax, eax
add dl, dl
jne 0x140723435
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14072353d
add dl, dl
jne 0x140723446
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140723453
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140723460
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14072346d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14072347a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14072340e
mov eax, 1
add dl, dl
jne 0x140723496
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407234a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14072348b
sub eax, ebx
mov ebx, 1
jne 0x1407234dc
mov ecx, 1
add dl, dl
jne 0x1407234be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407234cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407234b3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14072340e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407234f8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140723505
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407234ed
cmp eax, 0x7d00
jae 0x14072352b
cmp eax, 0x500
jb 0x140723526
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14072340e
cmp eax, 0x7f
ja 0x14072352e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14072340e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140723562
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14072340e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140029b84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d124
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d124
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029cd4
cmp rax, 0xffffffffffffffff
je 0x140029cd4
xor edi, edi
test rbp, rbp
jle 0x140029c7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fda4
mov rbx, rax
test rax, rax
jne 0x140029c0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029c75
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aac0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de00
cmp eax, 0xffffffff
je 0x140029c55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c1c
mov edx, r15d
mov ecx, r14d
call fcn.14001aac0
jmp 0x140029c75
cmp byte [rsi + 0x38], dil
je 0x140029c6c
cmp dword [rsi + 0x34], 5
jne 0x140029c6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029c75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b404
jmp 0x140029ce8
jns 0x140029ce8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d124
cmp rax, 0xffffffffffffffff
jne 0x140029ca0
cmp byte [rsi + 0x30], dil
je 0x140029ce8
mov edi, dword [rsi + 0x2c]
jmp 0x140029ce8
mov ecx, r14d
call fcn.1400195f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ce8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ce1
mov eax, dword [rsi + 0x2c]
jmp 0x140029ce6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d124
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0xdc
add al, 0x9b
xor al, 0xaa
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
wait
stosd dword [rdi], eax
invalid
Function at 0x140013008
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r15, rdx
mov r14, qword [r8 + 0x10]
mov rdx, r8
mov rdi, r8
mov rbp, rcx
jb 0x14001303e
mov rdx, qword [r8]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x14001306c
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r8, rax
inc rcx
imul r8, r9
cmp rcx, r14
jb 0x14001304f
mov rax, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and r12, r8
add r12, r12
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x140013092
mov rax, rbp
jmp 0x14001309a
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14001310f
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x1400130b0
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r13, qword [rsi + 0x10]
jb 0x1400130c1
mov rcx, qword [rsi]
cmp r13, r14
jne 0x1400130d2
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400130dc
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x140013087
cmp qword [rsi + 0x18], 0x10
jb 0x1400130e6
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
jb 0x1400130f0
mov rdi, qword [rdi]
cmp r14, r13
jne 0x140013107
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001310a
mov rbx, rbp
mov qword [r15], rbx
jmp 0x140013112
mov qword [r15], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140014158
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x14001417a
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x1400141aa
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x14001418c
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400141e2
cmp qword [rcx + rdx*8], r8
jne 0x1400141d7
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x1400141db
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400141ef
cmp qword [rcx + rdx*8], r8
jne 0x1400141ef
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.140013fe4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret