joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140118910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9, qword [0x1404971c8]
mov rbx, rdx
mov rax, r9
movsxd rsi, r8d
cqo
xor r15d, r15d
and edx, 0x1fff
mov rbp, rcx
add rax, rdx
mov r14d, r15d
and eax, 0x1fff
sub rax, rdx
sub r9, rax
mov rdi, rax
cmp rax, rsi
jle 0x140118a27
mov ecx, dword [0x1404971c0]
xor r8d, r8d
mov rdx, r9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x140497188]
mov r8d, edi
mov ecx, dword [0x1404971c0]
mov qword [0x1404971d0], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x140497198], eax
mov r9d, eax
cmp eax, edi
je 0x1401189a9
mov eax, 2
jmp 0x140118b2c
mov r8, qword [0x140497188]
lea eax, [rsi + 4]
movsxd rcx, eax
movsxd rdx, edi
sub rdx, rcx
add rdx, r8
mov qword [0x140497190], rdx
cmp rdx, r8
jb 0x140118a08
nop dword [rax + rax]
cmp byte [rdx], 0x50
jne 0x1401189db
mov eax, dword [rdx]
cmp eax, dword [rbx]
je 0x1401189ec
dec rdx
mov qword [0x140497190], rdx
cmp rdx, r8
jae 0x1401189d0
jmp 0x140118a08
mov eax, dword [0x140497188]
mov r14d, 1
sub eax, dword [0x140497190]
add r9d, eax
mov dword [0x140497198], r9d
movzx eax, word [r8]
mov rcx, qword [0x1404971e8]
mov word [rcx], ax
movzx eax, byte [r8 + 2]
mov byte [rcx + 2], al
mov r9, qword [0x1404971d0]
jmp 0x140118a2e
mov qword [0x1404971d0], r9
sub rbp, rdi
mov edi, 1
lea rax, [rbp + 0x1fff]
cqo
and edx, 0x1fff
lea rsi, [rdx + rax]
sar rsi, 0xd
test r14d, r14d
jne 0x140118b25
cmp edi, esi
jg 0x140118b22
mov ecx, dword [0x1404971c0]
sub r9, 0x2000
mov rdx, r9
mov qword [0x1404971d0], r9
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x140497188]
mov r8d, 0x2000
mov ecx, dword [0x1404971c0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x140497198], eax
cmp eax, 0x2000
jne 0x14011899f
mov rdx, qword [0x140497188]
lea rax, [rdx + 0x1fff]
mov qword [0x140497190], rax
cmp rax, rdx
jb 0x140118afb
cmp byte [rax], 0x50
jne 0x140118acd
mov ecx, dword [rax]
cmp ecx, dword [rbx]
je 0x140118ade
dec rax
mov qword [0x140497190], rax
cmp rax, rdx
jae 0x140118ac2
jmp 0x140118afb
mov eax, dword [0x140497188]
mov r14d, 1
sub eax, dword [0x140497190]
add eax, 0x2000
mov dword [0x140497198], eax
movzx eax, word [rdx]
inc edi
mov rcx, qword [0x1404971e8]
mov word [rcx], ax
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
test r14d, r14d
jne 0x140118b25
mov r9, qword [0x1404971d0]
jmp 0x140118a56
test r14d, r14d
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14011e860
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov r14, rcx
mov ebp, edx
test edx, edx
je 0x14011e938
mov eax, dword [0x140497198]
mov rdx, qword [0x140497190]
test eax, eax
jg 0x14011e8d8
mov rdx, qword [0x140497188]
mov r8d, 0x2000
mov ecx, dword [0x1404971c0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x140497198], eax
test eax, eax
je 0x14011e936
js 0x14011e912
mov rdx, qword [0x140497188]
add qword [0x1404971d0], 0x2000
mov qword [0x140497190], rdx
cmp esi, eax
mov rcx, r14
cmovb eax, esi
mov r8d, eax
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x140497190]
add r14, rdi
mov eax, dword [0x140497198]
add rdx, rdi
sub eax, edi
mov qword [0x140497190], rdx
mov dword [0x140497198], eax
sub esi, edi
jne 0x14011e896
jmp 0x14011e938
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
lea rcx, [0x1403a7080]
call qword [0x140497538]
xor eax, eax
jmp 0x14011e93a
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14011e960
Capabilities:
Encode data using xor
Read file on windows
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [0x1404972c0], 0
jne 0x14011e98d
mov rax, qword [0x1403a7140]
test rax, rax
jg 0x14011e995
dec rax
mov dword [0x140497198], 0
mov qword [0x1403a7140], rax
or eax, 0xffffffff
add rsp, 0x28
ret
mov qword [rsp + 0x20], rdi
mov edi, dword [0x140497198]
test edi, edi
jg 0x14011ea2a
mov rdx, qword [0x140497188]
mov r8d, 0x2000
mov ecx, dword [0x1404971c0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x140497198], eax
test eax, eax
jne 0x14011e9d8
or eax, 0xffffffff
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
jns 0x14011ea06
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
lea rcx, [0x1403a7080]
call qword [0x140497538]
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x140497188]
add qword [0x1404971d0], 0x2000
mov qword [0x140497190], rax
call fcn.14011d260
mov edi, dword [0x140497198]
mov rax, qword [0x140487170]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140497190]
test byte [rax + 0x28], 1
je 0x14011ea6c
test edi, edi
je 0x14011ea6c
call fcn.1401634e0
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.140163700
lea rbx, [rbx + 1]
sub edi, 1
jne 0x14011ea47
mov edi, dword [0x140497198]
mov rbx, qword [0x140497190]
dec edi
mov dword [0x140497198], edi
movzx eax, byte [rbx]
inc rbx
mov rdi, qword [rsp + 0x20]
mov qword [0x140497190], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14011ea90
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x1404971d8]
add r8, rcx
mov rax, r8
cqo
and edx, 0x1fff
add rax, rdx
and eax, 0x1fff
sub rax, rdx
mov rdx, r8
sub rdx, rax
mov rbx, rax
test r8, r8
jns 0x14011eb0d
mov r8, qword [0x1404971b8]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [0x140487178]
call fcn.1400e1500
mov r8d, eax
lea rdx, [0x140487178]
mov r9d, 1
lea rcx, [0x1403a7080]
call qword [0x140497538]
mov eax, 3
add rsp, 0x20
pop rbx
ret
cmp rdx, qword [0x1404971d0]
je 0x14011eb64
mov ecx, dword [0x1404971c0]
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x140497188]
mov r8d, 0x2000
mov ecx, dword [0x1404971c0]
mov qword [0x1404971d0], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x140497198], eax
test eax, eax
jg 0x14011eb5a
mov eax, 0x33
add rsp, 0x20
pop rbx
ret
sub eax, ebx
mov dword [0x140497198], eax
jmp 0x14011eb78
mov eax, dword [0x140497190]
sub eax, dword [0x140497188]
sub eax, ebx
add dword [0x140497198], eax
movsxd rax, ebx
add rax, qword [0x140497188]
mov qword [0x140497190], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14011ed60
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 2
lea rdx, [0x1401f961c]
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14011edaf
mov r8d, 2
lea rdx, [0x14025c1f4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x14011edc3
movzx eax, byte [rbx + 2]
test al, al
je 0x14011edc3
cmp al, 0x2f
je 0x14011edc3
cmp al, 0x5c
jne 0x14011ee95
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x14011edd6
cmp byte [rbx + 1], 0x3a
je 0x14011ee01
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x14011ee95
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x48], rbx
mov rdx, rbx
lea rcx, [0x14049758c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14011ef1d
mov rdx, qword [rsp + 0x48]
lea rcx, [0x14049758c]
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [0x14049758e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [0x14049758c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14011ee9c
mov byte [0x14049758c], al
xor eax, eax
jmp 0x14011ef22
xor eax, eax
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
setbe al
mov dword [0x140497590], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov r8d, 4
lea rdx, str.VFAT
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14011ef13
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14011ef13
mov r8d, 3
lea rdx, [0x14025c234]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
mov dword [0x140497594], 0
test eax, eax
jne 0x14011ef1d
mov dword [0x140497594], 1
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401dd140
add rsp, 0x290
pop rbx
ret
Function at 0x1401201b0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
mov r9d, 2
lea r8, [rsp + 0x30]
mov ecx, 0x400
lea edx, [r9 + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1401201f8
movsx edx, byte [rsp + 0x30]
sub edx, 0x30
je 0x1401201f8
sub edx, 1
je 0x1401201ee
cmp edx, 1
jne 0x1401201f8
lea eax, [rdx + 1]
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140120200
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
mov r9d, 2
lea r8, [rsp + 0x30]
mov ecx, 0x400
lea edx, [r9 + 0x1b]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x14012022b
movzx eax, word [rsp + 0x30]
test al, al
jne 0x14012022d
mov al, 0x2d
add rsp, 0x28
ret

Function at 0x1401208d0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x28
add cl, 0x40
mov word [rsp + 0x31], 0x2f3a
mov byte [rsp + 0x30], cl
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x33], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401216f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov dword [rsp + 0x70], 0xffffffff
mov qword [rsp + 0x30], rsi
lea rcx, str.CONIN_
or ebx, 0xffffffff
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401217d4
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14012175a
lea edx, [rbx + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rsi
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401217b9
cmp dword [rsp + 0x68], 1
jne 0x1401217b9
movzx ebx, byte [rsp + 0x60]
cmp ebx, 0xa
jne 0x1401217b9
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rsi
lea r8d, [rbx - 9]
mov rcx, rdi
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401217b9
cmp dword [rsp + 0x68], 1
jne 0x1401217b9
movzx ebx, byte [rsp + 0x60]
mov edx, dword [rsp + 0x70]
cmp edx, 0xffffffff
je 0x1401217cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140121c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
mov rcx, rbx
test eax, eax
jne 0x140121d9a
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
call fcn.14011ec30
mov ebp, eax
mov qword [rsp + 0x30], 0
mov eax, 0x80
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rax - 0x7d]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140121d87
lea r9, [rsp + 0x40]
mov rcx, rax
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140121d87
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x40]
test ebp, ebp
jne 0x140121d13
call fcn.14011ef40
cmp dword [rsp + 0x80], ebp
jne 0x140121cca
cmp dword [rsp + 0x84], ebp
jne 0x140121cca
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140121cdb
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.14011ef40
cmp dword [rsp + 0x88], 0
jne 0x140121cef
cmp dword [rsp + 0x8c], 0
je 0x140121d5b
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.14011ef40
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rbx
ret
call fcn.14011f3a0
cmp dword [rsp + 0x80], 0
jne 0x140121d36
cmp dword [rsp + 0x84], 0
jne 0x140121d36
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140121d47
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.14011f3a0
cmp dword [rsp + 0x88], 0
jne 0x140121d76
cmp dword [rsp + 0x8c], 0
jne 0x140121d76
mov rax, qword [rdi + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x30], rax
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.14011f3a0
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140121e02
test al, 0x10
je 0x140121e02
xor eax, eax
mov ecx, 0x210000
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
call fcn.14011da00
shl bx, 7
mov qword [rdi + 0x28], rax
not bx
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x20], rax
mov eax, 0x80
and bx, ax
mov eax, 0x4100
or bx, ax
mov word [rdi + 6], bx
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140123690
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1401ddd50
sub rsp, rax
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x1401236f6
cmp r9, qword [rcx]
je 0x1401236ec
test rdx, rdx
je 0x1401238e9
test r8d, r8d
js 0x1401238e9
mov eax, 1
mov qword [rcx], r9
jmp 0x140123702
mov rbp, qword [rcx]
test rbp, rbp
je 0x1401238e9
mov qword [rsp + 0xb0], r15
test r14, r14
je 0x1401237e5
mov rcx, rbp
call fcn.1401036d0
mov r15d, eax
cmp eax, 0x80
jle 0x14012373d
lea r8, str.j____int_sizeof_ctx__key_
mov edx, reloc.WS2_32.dll_WSACleanup
lea rcx, str..cryptohmachmac.c
call fcn.1400f37b0
cmp r15d, esi
jge 0x140123794
mov r8, r12
lea rcx, [rdi + 8]
mov rdx, rbp
call fcn.1400e6db0
test eax, eax
je 0x1401238d8
mov r8, rsi
lea rcx, [rdi + 8]
mov rdx, r14
call fcn.1400e7010
test eax, eax
je 0x1401238d8
lea r14, [rdi + 0x98]
mov r8, r14
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
call fcn.1400e6cd0
test eax, eax
je 0x1401238d8
jmp 0x1401237bc
cmp esi, 0x80
ja 0x1401238d8
mov r8, rsi
lea rcx, [rdi + 0x9c]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1401237ed
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rdi + 0x9c]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x1401237ed
test eax, eax
je 0x1401238c7
lea rcx, [rsp + 0x20]
mov rax, rdi
sub rax, rcx
mov rdx, rbx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140123810
mov r8, r12
lea rcx, [rdi + 0x38]
mov rdx, rbp
call fcn.1400e6db0
test eax, eax
je 0x1401238d8
mov rcx, rbp
call fcn.1401036d0
movsxd r8, eax
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
call fcn.1400e7010
test eax, eax
je 0x1401238d8
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x140123870
mov r8, r12
lea rcx, [rdi + 0x68]
mov rdx, rbp
call fcn.1400e6db0
test eax, eax
je 0x1401238d8
mov rcx, rbp
call fcn.1401036d0
movsxd r8, eax
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
call fcn.1400e7010
test eax, eax
je 0x1401238d8
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.1400e7120
test eax, eax
jne 0x1401238dc
xor eax, eax
jmp 0x1401238e1
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401dd140
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14015ad50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1401ddd50
sub rsp, rax
cmp dword [0x14036cf5c], 0
je 0x14015ad98
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14015ad7d
mov dword [0x14036cf5c], eax
jmp 0x14015ad98
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.1400e1010
cmp dword [0x14036cf5c], 0
jne 0x14015adb4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.1400e1010
add rsp, 0x28
ret
Function at 0x14015bde0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1401ddd50
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x14015becf
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14015becf
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x14015be7e
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14015be3a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14015be3a
cmp cl, 0xbb
jne 0x14015be6d
inc eax
cmp eax, ebx
jl 0x14015be24
sub ebx, eax
test eax, eax
jne 0x14015be82
mov dword [rsp + 0x20], 0x83
lea r9, [0x14036dbc0]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400e3440
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x14036dba8]
jmp 0x14015be4f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14015beb8
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, [0x14036dbd8]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400e3440
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], WSAStartup
lea r9, [0x14036db90]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400e3440
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140162fe0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov ecx, 0x400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140163038
xor r8d, r8d
mov r9, rax
nop word [rax + rax]
mov ecx, r8d
mov edx, 8
test cl, 1
je 0x140163017
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x140163019
shr ecx, 1
sub edx, 1
jne 0x140163008
mov dword [r9], ecx
inc r8d
add r9, 4
cmp r8d, 0x100
jl 0x140163000
mov qword [0x14039d328], rax
add rsp, 0x28
ret

Function at 0x140163070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x14016309e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140163040
mov r9, rax
not ebx
test rsi, rsi
je 0x1401630d3
nop dword [rax]
test dil, 3
je 0x1401630d3
movzx edx, byte [rdi]
mov ecx, ebx
xor rdx, rcx
inc rdi
shr ecx, 8
movzx eax, dl
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x1401630b0
cmp rsi, 0x10
jb 0x1401631e8
mov r10, rsi
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add rsi, rax
nop dword [rax + rax]
xor ebx, dword [rdi]
movzx ecx, bl
shr ebx, 8
mov edx, dword [r9 + rcx*4]
xor edx, ebx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 4]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 0xc]
add rdi, 0x10
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, edx
sub r10, 1
jne 0x1401630f0
cmp rsi, 4
jb 0x140163240
mov r10, rsi
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add rsi, rax
nop dword [rax]
xor ebx, dword [rdi]
add rdi, 4
movzx ecx, bl
shr ebx, 8
mov edx, dword [r9 + rcx*4]
xor edx, ebx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, edx
sub r10, 1
jne 0x140163200
test rsi, rsi
je 0x140163270
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
xor rcx, rax
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x140163250
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140163550
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rcx, rdx
call fcn.140163500
movsd xmm0, qword [rbx]
mov eax, dword [rbx + 8]
xor ebx, ebx
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
call fcn.1401634e0
movzx ecx, byte [rsp + rbx + 0x20]
xor eax, ecx
movzx ecx, al
mov byte [rsp + rbx + 0x20], al
call fcn.140163700
inc rbx
cmp rbx, 0xc
jl 0x140163583
mov rax, qword [0x140487170]
movzx edx, byte [rsp + 0x2b]
movzx ecx, byte [0x140497201]
test byte [rax + 0x28], 2
jne 0x1401635c4
movzx ecx, byte [0x140497207]
cmp edx, ecx
je 0x1401635de
or eax, 0xffffffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401dd140
add rsp, 0x40
pop rbx
ret
mov rax, qword [0x1403a7140]
mov rbx, qword [0x140497190]
mov qword [rsp + 0x60], rdi
movsxd rdi, dword [0x140497198]
cmp rdi, rax
cmovg edi, eax
test edi, edi
je 0x14016361a
call fcn.1401634e0
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.140163700
lea rbx, [rbx + 1]
sub edi, 1
jne 0x140163602
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401dd140
add rsp, 0x40
pop rbx
ret

Function at 0x140163700
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov r8d, dword [0x140497454]
mov eax, ecx
mov r9, qword [0x140497178]
mov r10d, ecx
mov edx, r8d
shr r8d, 8
xor rdx, rax
movzx eax, dl
mov edx, dword [r9 + rax*4]
xor edx, r8d
movzx eax, dl
add eax, dword [0x140497458]
imul ecx, eax, 0x8088405
mov dword [0x140497454], edx
inc ecx
mov edx, ecx
mov dword [0x140497458], ecx
mov ecx, dword [0x14049745c]
mov eax, ecx
shr edx, 0x18
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov eax, dword [r9 + rax*4]
xor eax, ecx
mov dword [0x14049745c], eax
mov eax, r10d
ret