joyce8/EMBER2024-capa huggingface dataset:
Function at 0x181411058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1814111df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181411089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18141106f
add dl, dl
jne 0x181411096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1814110f6
xor eax, eax
add dl, dl
jne 0x1814110a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1814111ad
add dl, dl
jne 0x1814110b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1814110c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1814110d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1814110dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1814110ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18141107e
mov eax, 1
add dl, dl
jne 0x181411106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181411113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1814110fb
sub eax, ebx
mov ebx, 1
jne 0x18141114c
mov ecx, 1
add dl, dl
jne 0x18141112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18141113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181411123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18141107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181411168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181411175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18141115d
cmp eax, 0x7d00
jae 0x18141119b
cmp eax, 0x500
jb 0x181411196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18141107e
cmp eax, 0x7f
ja 0x18141119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18141107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1814111d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18141107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000aaf0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x2e0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400ab2b8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rcx
mov qword [rsp + 0x78], rcx
mov r8d, 0x104
lea rdx, [r11 - 0x228]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000ab58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_install_service___d__n
call fcn.14000a330
jmp 0x14000acfd
xor esi, esi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140004bb0
cmp word [rsp + 0xc0], si
jne 0x14000ab8b
mov r8d, esi
jmp 0x14000abaa
lea rax, [rsp + 0xc0]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14000aba0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.14000b100
nop
mov r8, rbx
lea rcx, [rsp + 0xa0]
call fcn.14000b630
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14000b390
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xa0]
call fcn.140004bb0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000ac2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.14000a330
jmp 0x14000acea
lea r9, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r9, qword [rsp + 0x80]
lea rdx, [0x1400b1ba0]
mov r8, rdx
cmp qword [0x1400b1bb8], 8
cmovae r8, qword [0x1400b1ba0]
cmovae rdx, qword [0x1400b1ba0]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x14000accb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed___d__n
call fcn.14000a330
jmp 0x14000ace0
lea rcx, str.Service_installed_successfully_n
call fcn.14000a330
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x80]
call fcn.140004bb0
nop
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140004bb0
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140034240
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000fac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14000faf4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14000fae0
ret
Function at 0x140012ab0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140012d1e
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x140012d1e
cmp ecx, 0x29
jne 0x140012af8
cmp dword [rbx + 0x1c], 0
jne 0x140012d1e
test dword [rbx + 0x80], 0x10000000
je 0x140012d29
cmp ecx, 0x2e
jne 0x140012b5d
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140012f30
mov rax, qword [rbx]
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140012b50
cmp byte [rax], 0x5c
jne 0x140012b4d
inc rax
cmp rax, rcx
je 0x140012b4d
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x140012b3a
movzx ecx, byte [rax]
sub cl, 0x28
cmp cl, 1
jbe 0x140012b4a
test dl, 0x10
jne 0x140012b4d
movzx ecx, byte [rax]
sub cl, 0x7b
test cl, 0xfd
jne 0x140012b4d
mov qword [rbx], rax
inc qword [rbx]
mov rcx, rbx
call fcn.140011d50
jmp 0x140012d08
cmp ecx, 0x5c
jne 0x140012c1f
mov rax, qword [rbx]
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140012bab
cmp byte [rax], 0x5c
jne 0x140012ba8
inc rax
cmp rax, rcx
je 0x140012ba8
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x140012b95
movzx ecx, byte [rax]
sub cl, 0x28
cmp cl, 1
jbe 0x140012ba5
test dl, 0x10
jne 0x140012ba8
movzx ecx, byte [rax]
sub cl, 0x7b
test cl, 0xfd
jne 0x140012ba8
mov qword [rbx], rax
inc qword [rbx]
mov rcx, rbx
call fcn.140011d50
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x140012be1
cmp byte [rbx + 0x78], 0x62
jne 0x140012be1
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140012f30
mov rcx, rbx
call fcn.140012a50
jmp 0x140012d10
test eax, eax
je 0x140012c12
cmp byte [rbx + 0x78], 0x42
jne 0x140012c12
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140012f30
mov rax, qword [rbx + 0x48]
mov rcx, rbx
xor dword [rax + 0xc], 1
add rax, 0xc
call fcn.140012a50
jmp 0x140012d10
mov rcx, rbx
call fcn.1400133c0
jmp 0x140012d08
cmp ecx, 0x5b
jne 0x140012c4a
mov rcx, rbx
call fcn.140012a50
mov rcx, rbx
call fcn.140013300
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.140013290
jmp 0x140012d08
cmp ecx, 0x28
jne 0x140012c81
mov rcx, rbx
call fcn.140012a50
mov rcx, rbx
call fcn.1400134c0
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.140013290
test dil, dil
je 0x140012d10
jmp 0x140012d08
cmp ecx, 0x5e
jne 0x140012c9e
lea rcx, [rbx + 0x40]
mov edx, 2
call fcn.140012f30
mov rcx, rbx
call fcn.140012a50
jmp 0x140012d10
cmp ecx, 0x24
jne 0x140012cbb
lea rcx, [rbx + 0x40]
mov edx, 3
call fcn.140012f30
mov rcx, rbx
call fcn.140012a50
jmp 0x140012d10
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140012d4a
cmp ecx, 0x3f
je 0x140012d4a
cmp ecx, 0x7b
je 0x140012d4a
cmp ecx, 0x7d
jne 0x140012ce2
test dword [rbx + 0x80], 0x10000000
je 0x140012d34
cmp ecx, 0x5d
jne 0x140012cf3
test dword [rbx + 0x80], 0x10000000
je 0x140012d3f
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.140013760
mov rcx, rbx
call fcn.140012a50
mov rcx, rbx
call fcn.1400135e0
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x140012ad0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 5
call fcn.1400319a8
int3
mov ecx, 6
call fcn.1400319a8
int3
mov ecx, 4
call fcn.1400319a8
int3
mov ecx, 0xa
call fcn.1400319a8
int3
Function at 0x1400172a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x1400172b6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x140093f70]
not ecx
cmp r10d, 8
jb 0x1400173a8
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1400172e0
test r10d, r10d
je 0x1400173d0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x1400173b0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret

Function at 0x140017d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
imul esi, edx
mov rbp, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x140017d70
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140017d6a
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x140017da1
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
mov qword [rsp + 0x40], rbx
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x140017d88
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov rcx, r10
mov r8d, esi
call fcn.1400531c0
add dword [rdi + 0x2c], esi
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140018830
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14001884e
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rcx + 0x1c], 0
je 0x140018842
cmp qword [rcx + 0x80], 0
je 0x140018863
call fcn.140018da0
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140018660
test eax, eax
je 0x14001888a
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.140054bb8
mov rbx, rax
test rax, rax
jne 0x1400188b0
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.140054bb8
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x1400188f6
mov rcx, rbx
call fcn.140060494
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov ecx, ebp
cmp dword [rdi + 0x38], ecx
mov eax, dword [rdi + 0x40]
mov dword [rbx + 0x78], eax
sete cl
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x24], ebp
test ecx, ecx
jne 0x14001894d
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140017600
test eax, eax
jne 0x14001894d
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x140018978
movzx eax, byte [rdi + 0x3d]
jmp 0x14001897c
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
neg al
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
test rsi, rsi
je 0x140018a23
lea r8, [0x140093f70]
movzx eax, byte [rsi]
test al, al
je 0x140018a23
mov edx, dword [rbx + 0x9c]
mov ecx, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0xa0], ecx
movzx eax, byte [rbx + 0xa3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [rbx + 0xa4], eax
add rsi, 1
jne 0x1400189c0
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
add eax, 0x1e
mov rbp, qword [rsp + 0x20]
add ecx, eax
mov dword [rbx + 0x60], ecx
xor eax, eax
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140018ef0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rsi, rdx
mov rdi, rcx
jne 0x140018fc2
cmp dword [rcx + 8], 0xffffffff
jne 0x140018fc2
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140018f40
movzx ecx, word [rdi + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x140018f77
cmp cx, 0x2f
je 0x140018f77
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x140018f64
mov eax, dword [0x140096d10]
mov dword [rbx], eax
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140017b70
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x140018f9d
mov eax, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
call fcn.140018110
xor ecx, ecx
mov qword [rdi], rax
test rax, rax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0x1000000
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140019610
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x458
mov rax, qword [0x1400ab2b8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14001964d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001964d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rdi]
test ax, ax
je 0x14001975e
mov qword [rsp + 0x480], rbp
mov rdx, rdi
mov rcx, rdi
cmp ax, 0x2f
je 0x140019673
cmp ax, 0x5c
jne 0x140019676
mov rdx, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140019667
xor ebp, ebp
mov qword [rsp + 0x450], rsi
cmp rdx, rdi
je 0x1400196d4
sub rdx, rdi
lea rcx, [rsp + 0x230]
sar rdx, 1
lea rsi, [rdx + rdx]
mov rdx, rdi
mov r8, rsi
call fcn.1400531c0
cmp rsi, 0x208
jae 0x140019778
lea rdx, [rsp + 0x230]
mov word [rsp + rsi + 0x230], bp
mov rcx, rbx
call fcn.140019610
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x140019700
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400196f0
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x140019710
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140019720
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001974e
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140034240
add rsp, 0x458
pop rdi
pop rbx
ret
call fcn.1400349d0
int3
Function at 0x14001d000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10, r8
mov r9, rdx
test rdx, rdx
jne 0x14001d016
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x140095740]
not ecx
cmp r8, 8
jb 0x14001d104
mov r11, r8
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add r10, rax
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x14001d040
test r10, r10
je 0x14001d130
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x14001d110
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x14001d2e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400ab2b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0xe0]
mov r15, rdx
lea rdx, [rsp + 0x40]
mov r12, r9
mov r14, r8
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14001d32c
mov eax, 0x200
jmp 0x14001d53e
mov eax, dword [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x88], rbx
mov ecx, eax
xor ebx, ebx
mov qword [rsp + 0x80], rsi
and ecx, edx
cmovne ebx, edx
test al, 2
je 0x14001d355
or ebx, 2
test al, 4
je 0x14001d35c
or ebx, 4
mov edx, eax
and edx, 0x10
je 0x14001d366
or ebx, 0x10
test al, 0x20
je 0x14001d36d
or ebx, 0x20
mov eax, ebx
bts ebx, 0x1f
bts eax, 0x1e
test edx, edx
cmovne ebx, eax
bts ebx, 0x18
test ecx, ecx
jne 0x14001d388
bts ebx, 0x17
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0x28
jbe 0x14001d471
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x24]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
mov r8d, 4
lea rdx, [rsp + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [rsp + 0x30], ax
jne 0x14001d471
mov edx, dword [rsp + 0x34]
lea eax, [rdx + 0x34]
cmp esi, eax
jbe 0x14001d471
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
mov r8d, 4
lea rdx, [rsp + 0x3c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x3c]
cmp eax, 0x5a4d
je 0x14001d46d
add eax, 0xffffbab4
cmp eax, 4
ja 0x14001d471
mov ecx, socket
bt ecx, eax
jae 0x14001d471
bts ebx, 0x16
test r15, r15
je 0x14001d479
mov dword [r15], ebx
mov rbx, qword [rsp + 0x88]
test r14, r14
je 0x14001d489
mov dword [r14], esi
mov rcx, qword [rsp + 0x54]
mov rsi, qword [rsp + 0x80]
test r12, r12
je 0x14001d516
mov r8, qword [rsp + 0x4c]
movabs r10, 0xfe624e212ac18000
add r8, r10
movabs r9, 0xd6bf94d5e57a42bd
mov rax, r9
imul r8
add rdx, r8
lea r8, [rcx + r10]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r9
mov qword [r12], rdx
imul r8
mov rax, r9
add rdx, r8
sar rdx, 0x17
mov r8, rdx
shr r8, 0x3f
add rdx, r8
mov r8, qword [rsp + 0x44]
mov qword [r12 + 8], rdx
add r8, r10
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [r12 + 0x10], rdx
test rbp, rbp
je 0x14001d53c
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call fcn.14001d230
movzx ecx, word [rsp + 0x30]
movzx eax, word [rsp + 0x34]
shl ecx, 0x10
or ecx, eax
mov dword [rbp], ecx
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140034240
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001d640
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x14001d747
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x14001d682
cmp dword [rbx + 0x58], edi
jae 0x14001d682
call fcn.14003487c
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x14001d698
lea ecx, [rdi + rdi]
call fcn.1400348c0
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.1400531c0
test edi, edi
je 0x14001d73e
xor r11d, r11d
lea rsi, [0x140095740]
nop dword [rax]
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov r8d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x44]
mov r9d, r8d
mov ecx, edx
and r9d, 0xfffd
movsx r10, byte [r11 + rax - 1]
or r9d, 2
xor rcx, r10
shr edx, 8
movzx eax, cl
mov ecx, dword [rsi + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [rbx + 0x48]
mov dword [rbx + 0x44], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x48], ecx
movzx eax, byte [rbx + 0x4b]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
imul ecx, r9d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rbp, 1
jne 0x14001d6c0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x14001d797
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x14001d774
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.1400531c0
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001d7ce
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret