joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180041050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800410b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180041070
mov ecx, dword [r9]
jmp 0x180041198
cmp ecx, 0x4e0
jb 0x180041198
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800410d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180041120
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800411e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov rsi, rcx
sar rbp, 1
mov r14, r9
mov r15, r8
mov rdi, rdx
mov r12, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x180041255
nop word [rax + rax]
lea rbx, [rcx + rcx]
mov r8, qword [rsi + rbx*8 + 8]
lea rcx, [rsp + 0x70]
mov rdx, qword [rsi + rbx*8 + 0x10]
call fcn.18003f420
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rbx
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rcx
cmp rcx, rbp
jl 0x180041220
cmp rcx, rbp
jne 0x18004126d
test r15b, 1
jne 0x18004126d
mov rax, qword [rsi + r15*8 - 8]
mov qword [rsi + rdi*8], rax
lea rdi, [r15 - 1]
mov rax, qword [rsp + 0x70]
lea rbx, [rdi - 1]
sar rbx, 1
mov qword [rsp + 0x70], rax
cmp r12, rdi
jge 0x1800412c0
mov r15, qword [r14]
nop word [rax + rax]
mov rbp, qword [rsi + rbx*8]
lea rcx, [rsp + 0x70]
mov rdx, rbp
mov r8, r15
call fcn.18003f420
test al, al
je 0x1800412ba
mov qword [rsi + rdi*8], rbp
mov rdi, rbx
dec rbx
sar rbx, 1
cmp r12, rdi
jl 0x180041290
mov qword [rsi + rdi*8], r15
jmp 0x1800412c7
mov rax, qword [r14]
mov qword [rsi + rdi*8], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180044560
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x98], 0
mov rbx, rcx
jne 0x1800445fe
movaps xmmword [rsp + 0x40], xmm6
movups xmm6, xmmword [0x1801a6110]
call fcn.1800aa390
mov qword [rsp + 0x28], 5
lea rcx, str..text
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r9, rax
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm6
call fcn.1800aa080
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
mov edx, 4
mov r8d, 0x40
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov dword [rsp + 0x60], 0
mov qword [rbx + 0x98], rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movaps xmm6, xmmword [rsp + 0x40]
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x180044612
mov eax, dword [rbx + 0xa0]
mov dword [rcx], eax
add rsp, 0x50
pop rbx
ret

Function at 0x180045550
Capabilities:
Log keystrokes via polling

Disassembly:
test rdx, rdx
je 0x180045629
push rbx
sub rsp, 0x30
mov rax, qword [rdx]
mov rbx, rcx
mov rcx, rdx
call qword [rax + 0x1f0]
test al, al
je 0x180045624
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18004561d
cmp byte [rbx + 0x99], 0
jne 0x180045624
mov edx, 0x57
movaps xmmword [rsp + 0x20], xmm6
call fcn.1800a4460
test al, al
jne 0x1800455d1
mov edx, 0x41
call fcn.1800a4460
test al, al
jne 0x1800455d1
mov edx, 0x53
call fcn.1800a4460
test al, al
jne 0x1800455d1
mov edx, 0x44
call fcn.1800a4460
movss xmm6, dword [rbx + 0x9c]
mov dword [rbx + 0xa4], 1
mov rcx, qword [0x1801a5878]
test rcx, rcx
jne 0x1800455f3
xor eax, eax
jmp 0x1800455ff
mov rax, qword [rcx]
mov rdx, qword [rax + 0xe0]
call rdx
mov rax, qword [rax + 0x2c8]
movss dword [rax + 0x1c], xmm6
movaps xmm6, xmmword [rsp + 0x20]
mov byte [rbx + 0x99], 1
add rsp, 0x30
pop rbx
ret
mov byte [rbx + 0x99], 0
add rsp, 0x30
pop rbx
ret
Function at 0x18004e6d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18004e73d
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x18004e706
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp fcn.18004e750
call fcn.18004f3b0
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.18004efa0
add rsp, 0x20
pop rbx
ret
Function at 0x18004e750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, r8
je 0x18004e946
cmp qword [rdx + 0x28], 0xf
lea r8, [rdx + 0x10]
mov rax, qword [rdx + 8]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov r13, qword [rcx + 8]
mov qword [rsp + 0x28], r14
mov r14, qword [rcx + 0x18]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x68], rax
jbe 0x18004e7ab
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
test r9, r9
je 0x18004e7e4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x18004e7d0
mov r15, qword [rdi + 0x30]
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r14
mov rax, qword [r15]
mov r12, qword [r15 + 8]
mov qword [rsp + 0x70], rax
call fcn.18004f450
dec qword [rdi + 0x10]
cmp rsi, r12
je 0x18004e833
mov r14, rbx
cmp rbx, rbp
je 0x18004e847
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.18004f450
dec qword [rdi + 0x10]
cmp r14, r12
jne 0x18004e812
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x68]
cmp qword [rsp + 0x70], rsi
jne 0x18004e862
mov qword [r15], r13
mov rax, r13
jmp 0x18004e865
cmp qword [rsp + 0x70], rsi
jne 0x18004e851
mov qword [r15], rbx
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
mov qword [rbx + 8], rax
jmp 0x18004e92d
mov rax, r12
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x18004e925
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jbe 0x18004e895
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x18004e8c9
movabs r12, 0x100000001b3
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r12
cmp rdx, r9
jb 0x18004e8b0
mov r12, qword [rsp + 0x68]
mov r15, qword [rdi + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
add r15, r14
mov r14, qword [r15 + 8]
call fcn.18004f450
dec qword [rdi + 0x10]
cmp rsi, r14
je 0x18004e90c
nop
mov rsi, rbx
cmp rbx, rbp
je 0x18004e922
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.18004f450
dec qword [rdi + 0x10]
cmp rsi, r14
jne 0x18004e8f0
mov qword [r15], r13
mov qword [r15 + 8], r13
cmp rbx, rbp
je 0x18004e925
mov r14, qword [rsp + 0x78]
jmp 0x18004e880
mov qword [r15], rbx
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004eab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rdi
push r13
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov r13, rcx
mov qword [rsp + 0x58], rsi
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0x60], r12
mov r12, qword [rdx + 0x18]
mov qword [rsp + 0x28], r14
mov r14, rdx
cmp r12, 0xf
jbe 0x18004eae4
mov rdx, qword [rdx]
xor edi, edi
movabs rbp, 0xcbf29ce484222325
mov ecx, edi
test rsi, rsi
je 0x18004eb14
movabs r8, 0x100000001b3
movzx eax, byte [rdx + rcx]
inc rcx
xor rbp, rax
imul rbp, r8
cmp rcx, rsi
jb 0x18004eb01
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, rbp
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x18004eb87
mov qword [rsp + 0x20], r15
mov r15, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x18004eb52
mov rdx, qword [rdx]
mov rcx, r14
cmp r12, 0xf
jbe 0x18004eb5e
mov rcx, qword [r14]
cmp rsi, rax
jne 0x18004eb74
test rsi, rsi
je 0x18004eb7f
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18004eb7f
cmp rbx, r15
je 0x18004eb82
mov rbx, qword [rbx + 8]
jmp 0x18004eb40
mov rdi, rbx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test rdi, rdi
je 0x18004ec13
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rbp
add rax, rax
lea r8, [rcx + rax*8]
lea rdx, [rcx + rax*8]
mov rax, qword [rcx + rax*8]
cmp qword [r8 + 8], rdi
jne 0x18004ebdc
cmp rax, rdi
jne 0x18004ebd2
mov rax, qword [r13 + 8]
mov qword [rdx], rax
mov qword [r8 + 8], rax
jmp 0x18004ebe7
mov rax, qword [rdi + 8]
mov qword [r8 + 8], rax
jmp 0x18004ebe7
cmp rax, rdi
jne 0x18004ebe7
mov rax, qword [rdi]
mov qword [rdx], rax
mov rcx, qword [rdi]
mov rdx, rdi
dec qword [r13 + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
call fcn.18004f450
mov eax, 1
add rsp, 0x30
pop r13
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbp
ret
Function at 0x180055c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
call fcn.180006b00
cmp qword [rbx + 0x18], 0xf
mov r8, rbx
jbe 0x180055cb9
mov r8, qword [rbx]
mov rdx, r8
mov rax, r8
jmp 0x180055cbf
mov rax, rbx
mov rdx, rbx
add rdx, qword [rbx + 0x10]
mov rcx, rdx
sub rcx, r8
cmp r8, rdx
cmova rcx, rdi
test rcx, rcx
je 0x180055d2f
cmp rcx, 0x40
jb 0x180055d2f
movdqa xmm1, xmmword [0x1800caab0]
and rcx, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rdi, 0x40
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp rdi, rcx
jne 0x180055cf0
cmp rax, rdx
je 0x180055d3f
xor byte [rax], 0x7f
inc rax
cmp rax, rdx
jne 0x180055d34
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18005d9d0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rcx + 0x3c], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
mov ecx, dword [0x1801a573c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801a6874], ecx
jle 0x18005daaa
lea rcx, [0x1801a6874]
call fcn.1800ac678
cmp dword [0x1801a6874], 0xffffffff
jne 0x18005daaa
movups xmm6, xmmword [0x1801a6480]
call fcn.1800aa390
lea rdx, str..text
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 5
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm6
mov r9, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1800aa080
mov rax, qword [rsp + 0x60]
mov qword [0x1801a6878], rax
lea rcx, [0x1801a6874]
call fcn.1800ac60c
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [0x1801a6878]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x180072510
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180072538
xor eax, eax
lea r8, [0x1800722b0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180076480
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800764dd
lea rbx, [0x1800ba200]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800764c4
cmp r10, 2
jb 0x1800764c4
cmp byte [r9], r8b
jne 0x1800764c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800764a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18007651f
lea rbx, [0x1800ba200]
cmp r8b, 0x23
jne 0x180076503
cmp byte [r9], r8b
jne 0x180076503
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800764f0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180076660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18007667a
mov qword [r8], 0
lea rdx, [0x1800c7248]
call fcn.180076530
mov rbx, rax
test rax, rax
jne 0x18007669a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180076773
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180076773
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180076773
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180076773
cmp rdi, 0xffffffffffffffff
je 0x180076773
mov rax, qword [0x1801a5868]
test rax, rax
je 0x180076710
inc dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180076773
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180076760
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1801a5868]
test rax, rax
je 0x180076755
dec dword [rax + 0xf0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18007677c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18007676e
mov qword [r14], rdi
mov rax, rsi
jmp 0x18007677e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180078b70
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1800ba200]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f50], ebx
jne 0x180078c08
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18008ad20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18007c010
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18007c060
lea r11, [0x1800ba200]
nop dword [rax]
cmp r9b, 0x23
jne 0x18007c043
cmp byte [r8], r9b
jne 0x18007c043
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18007c030
mov rcx, qword [0x1801a5868]
not eax
movsxd rdx, dword [rcx + 0x3ee8]
mov r9, qword [rcx + 0x3ef0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18007c0c1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18007c0b9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18007c0bc
mov rdx, r8
test rdx, rdx
jne 0x18007c090
cmp r9, r10
je 0x18007c0d0
cmp dword [r9], eax
jne 0x18007c0d0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180089470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ce0], 0
lea rbx, [rcx + 0x5ce8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180089517
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800894ca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18008beb0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180076b70
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ce0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cf0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1801a5860]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18008951f
mov rcx, rbx
call fcn.180076b70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800899a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1801a5868]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180089a03
mov qword [rsp], rbx
lea rbx, [0x1800ba200]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800899e3
cmp byte [r8], r9b
jne 0x1800899e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800899d0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c50]
not eax
mov r8, qword [r10 + 0x5c58]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x180089a2f
cmp dword [r8 + 8], eax
je 0x180089a36
add r8, 0x48
cmp r8, rcx
jne 0x180089a20
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1800a8d84
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x1801a6f30]
mov r8b, byte [rbx + 0x20]
mov rdx, qword [rbx]
mov rdi, rdx
and r8b, 1
je 0x1800a8dbb
lea rdi, [rdx - 5]
movzx eax, r8b
lea rcx, [rdx - 5]
test r8b, r8b
lea r9, [rsp + 0x30]
mov r8d, 0x40
cmove rcx, rdx
lea rbp, [rax*2 + 5]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a8df4
mov eax, 0xa
jmp 0x1800a8e80
test esi, esi
je 0x1800a8e16
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800a8e37
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800a8e37
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800a8e31
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800a8e37
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a92b0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x1800a9316
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800a9307
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800a92fd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800a92d1
mov r8, qword [rbx]
mov rcx, qword [0x1801a50f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret